The case against teaching math - <AUTHOR> http://www.ordinary-gentlemen.com/2010/03/the-chloroformed-mind-the-case-against-teaching-math/

<comment><USER3> Bear with me here, I have to lay down some foundation to get to my point.

 _Bias_ has a specialized definition in machine learning; in a (really thin) nutshell, it represents the set of concepts a given technique can represent. If your banana vs. ball classifier can only represent "roundness" and "yellowness", the bias will prevent it from seeing a yellow cube as anything but a banana. (If you really dig in, I find this concept is really a superset of the traditional meaning of "bias" and find it a lot more edifying, but that's beyond this post.)

A learning agent, even a human, can only learn what their biases permit. Much of intellectually growing up is the process of learning better biases, for instance putting away "magic" and replacing it with "chemistry". If you've ever _felt_ your brain stretching as you learn something (a foreign language, Haskell, etc), that's your biases growing. Characterizing growing biases mathematically has been a great challenge for machine learning, but it clearly happens to humans.

Alright, getting up to the payload here: I have actually had similar concerns about our educational patterns before because you can't effectively teach something until you have the necessary biases in place. Unfortunately, you can't stop learning, you are always learning. So what happens when you "teach" something to students that lack the ability to apply the correct biases? You get the square yellow cube effect above... one way or another it _will_ fit the biases you have (give or take growth, which takes time). The result is semantic gibberish. Now, by itself it is inevitable that you will go thorough quite a lot of gibberish as you grow up (see also "Kids Say the Darndest Things"), but why are we using precious school time to do that for math?

Furthermore, it is transparently obvious that things can be taught too soon. My 18-month-old is frolicking around my feet now, and he can't add. There's not much I can do to correct that right now. At some point he will, but this suffices to prove the point that there is a "too soon". So, when is it no longer "too soon"? Are we really sure that our traditional answer is anything more than traditional, that it has any actual truth?

Teaching things early is not harmless, either. Think about it; how many adults have downright childish issues with math? Childish misunderstandings, childish opinions, childish beliefs? Coincidence? Bad motivation? Or a schooling system that jammed it into their brains before they were ready. And those that don't have childish problems... is it merely because we were ready soon enough, rather that necessarily any actual unique skill? Some people never recover.

It is at least a question worth research and thought before we knee-jerk an answer of "if it was good enough for my grandpappy it's good enough for you".

(Getting a little more controversial, this is why I don't support really early sex education (i.e., elementary school). You will accomplish nothing except hilarious misunderstandings on a very important topic. This can have real, negative consequences, and the intentions count for nothing.)

<comment><USER4> _Think about it; how many adults have downright childish issues with math? Childish misunderstandings, childish opinions, childish beliefs? Coincidence? Bad motivation?_

Right here. I taught myself programming and I got pointers (references, same difference) within the first week I started reading about php. I enjoy learning new concepts except for math. I really want to learn math but I am so afraid of just opening a math book and not understanding anything in it. (Posttraumathematic stress disorder?)

<comment><USER5> Are you in school? Get an independent study going with a professor on a topic she likes and you wouldn't mind learning. Emphasize that you want to get your training wheels for autodidactic math education.

<comment><USER4> Sadly, I'm graduating in 6 weeks. I think I'll have to figure it out on my own.

<comment><USER6> May be you've seen these HN threads about self-learning maths already... if not, hopefully you'll find these textbooks useful. Here's a little HN link dump, in the order of time at which the discussions took place (from the oldest to the most recent):

\- <http://news.ycombinator.com/item?id=108723>

\- <http://news.ycombinator.com/item?id=201913>

\- <http://news.ycombinator.com/item?id=458926>

\- <http://news.ycombinator.com/item?id=755043>

\- <http://news.ycombinator.com/item?id=1058359>

\- <http://news.ycombinator.com/item?id=1193352>

One caveat is that many of these textbooks do not come with a solutions manual. So, in terms of practice, I think that's where the dearth of uploaded lecture materials could come in. Sometimes, there might be no e-learning/opencourseware material for the topic you're interested in. In such cases, I found that if you look through universities' Websites closely enough, professors upload a lot of course materials on their personal pages. You can do this by finding a random university's math dept. page, then searching from course/faculty listings.

Last of all, I'm pretty certain you've heard of this site already, as it's being circulated quite a lot lately, but many have professed that videos from khanacademy.org to be quite helpful when grasping basic mathematical concepts.

<comment><USER4> Thanks for the list. Saves me from cluttering HN with a another similar thread. :)

</comment></comment></comment></comment></comment></comment><comment><USER7> This story is dead on. I know this from personal experience and from teaching my own children. I could not add until I was 10. It was painful. I still remember it vividly. Suddenly everything clicked, and I rocketed through all the material I was behind on.

I have six children, five of which are old enough to be in school. We have been home schooling them, I believe I have some creds on this.

Two of them (both girls) took right to math early on. No problem there. Two of them (both boys) couldn't be bothered, no matter what method we tried.

One of the girls was doing math before she could read, because she was a late reader. Couldn't read until she was 9. But suddenly she got it, and took off, and is reading voraciously today. Her younger sister was reading at 4.

Both boys are now doing pre-algebra. One is 13, the other 11.

We decided not to sweat it when thy were way behind. We just kept getting them to do what they could. If they weren't getting some concept, we went slower, or went to other topics they could understand. Eventually everything started clicking.

Cookie-cutter education could never do this. I agree that national education standards that fit all children into specific requirements by age, are foolish and harmful. As guidelines they are fine, but if the government is behind them they are never just guidelines. They won't fix the problem of bad and lazy teachers (in fact, they make that problem worse), and they don't help good teachers teach better.

<comment><USER8> Just adding my own experience to this: Until the age of 15, maths was considered a real "problem subject" for me. At every parent-teacher conference it was generally accepted that I would never be good at it (and I had no problem with that at all - I found the whole subject very boring and difficult).

Then one day, at age 15, a classmate showed me how to do quadratic equations. I have no idea why, but that day a really bright light suddenly switched on for me. I quickly caught up to, and then passed the abilities of everyone else in the class, and then started teaching myself calculus in my spare time. I went on to get a PhD in Pure Mathematics.

I do think I just _wasn't ready_ for a long time.

<comment><USER9> I'm curious - before math clicked for you, were you good at other subjects and generally one of the brightest in your class? IE - did your teachers think you were dumb overall, or just that you were a smart kid who for some reason didn't get math?

<comment><USER8> I was always good in the sciences, especially physics, and also in music. My teachers seemed to think I was smart, but they definitely thought I would never get maths.

</comment></comment></comment></comment><comment><USER10> I disagree with this.

Sure, kids don't like math. I myself didn't like math when I was a kid. Why? Well, because math takes work. Sometimes lots of work.

I believe a solution to this has to do with _how_ math is taught, as opposed to just abolishing the subject altogether. I don't hate math any longer - <USER2> can sometimes see the beauty in it, and I sure as hell know that it comes in handy, especially when working with computers.

But even if it isn't taught properly - there is something to be said for doing math at an elementary level. Working on math problems tend to give you a certain kind of mental tenacity, that would come in handy later. The question, really, is how to make math seem fun/relevant - especially when it gets more abstract.

Steven Strogatz has some cool ideas: [http://opinionator.blogs.nytimes.com/category/steven- strogat...](http://opinionator.blogs.nytimes.com/category/steven-strogatz/)

<comment><USER11> I used to skive off school and go down the woods and do maths problems to entertain myself, so that I could avoid Irish lessons.

</comment></comment><comment><USER12> Completely False. I started to learn mathematics starting in preschool and when I arrived in the US I was shocked by what passed as mathematics education in the US. The stuff American students where doing in 6th grade I had already done in 3rd grade. It might be that starting later is a good idea but the exact opposite was true for me. If I had been forced to learn mathematics the way American students learn it, well then I would have been bored out of my mind and would have given up learning it.

<comment><USER13> The American education system is constantly changing. I don't even know how they teach math to kids these days but I would probably think it was completely foolish. Apparently they changed the way they teach spelling and vocabulary and I think the new method is complete nonsense.

But the point of the article is that the current mantra seems to be that if 'kids aren't good at math in grade X' then 'teach even more math at grade X-1', which has diminishing returns when you start getting down to kindergarten and such.

</comment></comment><comment><USER14> I learned maths AND was able to solve "story problems" in elementary school.

Looking back, the maths taught in elementary school is very basic, too. Just multiplication and division of integers, not even fractions yet.

To be honest, I don't care that much anymore if somebody doesn't want to learn maths. It's just their loss. But maths was one of the few things I enjoyed at school, so I absolutely see no point in removing it from the curriculum.

There are some school forms (like Montessori I think, quite popular here in Germany), where pupils can apparently choose for themselves what they want to learn at any particular moment. Not sure how exactly it works, but might be a good idea.

<comment><USER15> In Montessori, there is some emphasis on choosing what you're interested in, but I think the more important part (when it comes to math) is that it's typically taught using strong visuals, manipulation of number blocks/cubes, etc. Instead of focusing on rote memorization of algorithms, the focus is on patterns and sensory experience. Kids "get" patterns; what they struggle with is algorithms applied to symbols.

I went through "normal" school and was always way ahead in math. My Montessori-educated sister, 3 years younger than me and not particularly mathematically inclined, could intelligently converse with me about my algebra homework when I was in sixth grade and she was in third. She wasn't as familiar with the symbols as I was, but she recognized many of the patterns (like difference of squares) in physical form.

The Montessori math approach is outlined at <http://www.infomontessori.com/mathematics/introduction.htm>

</comment></comment><comment><USER16> This is blogspam. The original article from Psychology Today was already submitted to HN.

<http://news.ycombinator.com/item?id=1211198>

But I must acknowledge that some searches for submissions of the original article that I just tried on Google failed, although SearchYC works with enough keywords.

<comment><USER4> I don't think this sinks to the level of blogspam. The OP made a summary of the original and added his own comments. I looked at the first few entries on the home page and most of them seemed to be in this format. There is original content here and the guy writes well. To call it blogspam is (in my opinion) wrong.

Note: Wikipedia defines blogspam as "the post of a blogger who creates no- value added posts to submit them to other sites".

<comment><USER17> I agree. And the folks at that blog don't typically do the blogspam thing, at least in my experience.

</comment></comment></comment><comment><USER18> No math until after elementary school? what? I remember doing multiplication timed tests in 2nd grade, waiting until 6th grade would seem to be catering to the lowest common denominator and doing a great disservice to many bright students.

</comment><comment><USER19> Can someone tell me WTF "pre-calculus" is meant to mean? AFAICT, it's just a fancy word for algebra.

<comment><USER20> If I remember, since geometry is such a large topic, pre-calculus also teaches the parts of geometry necessary for traditional calculus study. That way, the geometry course can be made more simple.

<comment><USER19> You don't need any geometry to understand algebra. Though graphs (and therefore cartesian co-ordinates) certainly help).

<comment><USER20> To understand calculus, not algebra.

<comment><USER19> Well corrected. |You don't need geometry to understand calculus, either.

</comment></comment></comment></comment></comment><comment><USER21> This is silly. He's on his way to make a good point, but fails when his main points become 1) no math 2) focus on stories and language early on.

The good point he could have arrived at is to put less emphasis on things a child is not immediately acquiring. It would be like trying to force-feed mashed potatoes down a drinking straw. Perhaps sometimes it's math. Perhaps sometimes it's music.

Instead, he just says, stories and language are the important part! Leave math for later!

What a buffoon. He started with a bigger picture that ended with a close- minded detail.

To the original author, remind yourself that "not everyone is you." Kids can grow up to be scientists, artists, doctors, lawyers, even _gasp_ mathematicians! And we all take different paths, even at a young age.

</comment><comment><USER22> Just a slight quibble:

> R–recitation. He wrote that by "recitation" he meant, "speaking the English > language." He did "not mean giving back, verbatim, the words of the teacher > or the textbook." The children would be asked to talk about topics that > interested them–experiences they had had, movies they had seen, or anything > that would lead to genuine, lively communication and discussion. This, he > thought, would help them develop the capacity to reason and communicate > logically.

He means "rhetoric." That's what the _second_ "R" of the "Three Rs" (a.k.a. the Trivium) is supposed to mean.

</comment><comment><USER22> This occurred to me when I took my first college psych course, and we were talking about "operational stages." The whole lecture was about how kids can't work with disconnected mental abstractions until they reach a certain level of cognitive development (the Formal Operational Stage.) It was also enforced that moving between stages of cognitive development just takes _time_ , not more or better prerequisite education. In that light, it's kind of obvious that young children shouldn't be being taught math, any more than they should be being taught first-order logic.

</comment><comment><USER23> I think that intrinsic motivation is key, without it, it will be impossible to really learn. If you don't have intrinsic motivation to learn something, you can always go fotr the monkey approach, where you ape after your instructor to finish a task, or solve a problem. That is by no means "learning" though.

</comment><comment><USER24> You lost me at "Psychology Today".</comment>


Telling the Truth About Defects in Technology Should Never Be Illegal - <AUTHOR> https://www.eff.org/deeplinks/2018/08/telling-truth-about-defects-technology-should-never-ever-ever-be-illegal-ever <comment><USER2> You read Cory Doctorow talking about vulnerability research and you get the impression that there's a war out there on security researchers. But of course, everything else in Doctorow's article aside, there isn't: the field of vulnerability research has never been healthier, and there have never been more companies _explicitly authorizing_ testing of their servers than there are now.

There isn't an epidemic of prosecutions of vulnerability researchers --- in fact, there are virtually no such prosecutions, despite 8-10 conferences worth of well-publicized independent security teardowns of everything from payroll systems to automotive ECUs. There are so many random real-world things getting torn down by researchers that Black Hat USA (the industry's biggest vuln research conference) had to make a whole separate track to capture all the stunt hacking. I can't remember the last time someone was even C&D'd off of giving a talk.

I'm a vulnerability researcher (I've been doing that work professionally since the mid-1990s) I've been threatened legally several times, but all of them occurred more than 8 years ago. It has never been better or easier to be a vulnerability researcher.

Telling the truth about defects in technology isn't illegal.

Doctorow has no actual connection to the field, just a sort of EFF-style rooting interest in it. I'm glad he approves of the work I do, but he's not someone who I'd look to for information about what's threatening us. I'm trying think of something that might be a threat... credentialism, maybe? That's the best I can come up with. Everything is easier today, more tools are available, things are cheaper, more technical knowledge is public; there are challenges in other parts of the tech industry, but vuln research, not so much.

<comment><USER3> > the field of vulnerability research has never been healthier, and there have > never been more companies explicitly authorizing testing of their servers > than there are now.

> in fact, there are virtually no such prosecutions

> Telling the truth about defects in technology isn't illegal.

These statements don't seem to add up. If it's legal to tell about defects, then all of EFF's work (on this case) is a waste of time and they're spreading misinformation.

If it's legal to do what they're doing then there should be zero prosecutions.

Companies wouldn't need to authorize anyone because what they are doing is legal.

Edit: added some clarification

<comment><USER2> I kind of love this comment. "This doesn't add up... if what you're saying is true, EFF is misleading people".

Yes. I think EFF often does mislead people. They do some important work, and some less well-intentioned advocacy stuff.

I supported my argument with evidence. To wit: if what researchers do is "illegal", consider this year's Black Hat schedule, and ask why none of these presentations generated so much as a C&D, let alone a threatened criminal prosecution: MDM attacks, attacks on self-driving cars (including Tesla's ECU), breaks in "16 desktop applications, 29 websites, and 34 mobile applications" in the fintech space, attacks on ATMs, industrial control gateways, VPNs, ICS firewall products, antivirus software, "Akamai, Varnish Cache, Squid Proxy, Fastly, IBM WebSphere, Oracle WebLogic, F5", a smartphone baseband, every macOS firewall product, mobile point of sales systems including "Square, SumUp, iZettle, and Paypal", SAML SSO's, SATCOM, WinVote voting machines, LTE base stations, z/OS for Christ's sake, streaming video watermarking schemes, "a cross-section of smart city devices currently in use today", Toshiba FlashAir SD cards, warning siren systems from ATI Systems, celllular devices manufactured by Sierra Wireless and many others, implanted medical devices, text-to-speech systems, and a hardware backdoor in an x86 clone.

What prosecutions would you put on the other side of this scale to balance it out? It sounds like the best argument the thread has seen so far is Aurenheimer, who dumped a database and bragged to the media about his "theft". I don't support that prosecution and didn't at the time, but if that's the best evidence you've got, I'm not going to be up nights worrying about this.

I work in this field. Cory Doctorow's relation to it is that of a gadfly. I'm saying outright: I think this article is misleading.

You'll have no trouble finding vulnerability researchers to take the other side of my argument, that we're all a threatened species ready to be pushed underground at any moment by overzealous prosecutors. We've been saying that for literally decades, and I think it has more to do with us wanting to feel exceptional and daring than it does with any real risks we face.

<comment><USER4> Companies giving researchers permission to do something is inherently different from it being legal to do something. In one case you are able to operate only at the whims of the companies you're researching. The companies can for any reason, and at any time, withdraw their consent and take legal action against a researcher. Yo can debate the likelihood of that ad nauseuam, however it would seem to still be a potential risk. In the other case, your are free to operate as you see fit because you have every legal right to investigate and go about your business. As far as I can tell, you're arguing that the former circumstances are good enough, whereas the author and apparently the EFF and ALCU are trying to obtain the former.

<comment><USER2> Almost none of those were vendors giving permission; I left out dozens of talks where it was clear permission had been given (for instance: no Apple or Microsoft talks on that list).

<comment><USER4> Again, I'm not disagreeing that the current state of affairs might be good enough for people to work in this field with some degree of confidence they won't suddenly be facing crippling consequences for work that everyone generally agrees is important. I'm simply pointing out that a handshake agreement that companies won't sue or press charges against researchers is a far cry from the legal protection that the EFF and ALCU hope to gain. Imagine a scenario where some vindictive CEO/Founder (I can think of a few) takes offense to a researcher publicizing vuln/flaws in a new flagship product that embarrasses them or the company. Imagine that CEO decides to make a point by violating the "understanding" researchers and companies have so far enjoyed, and files suit or even worse presses charges. Currently that researcher has no protection. Even if that's a rare and unlikely occurrence, that researcher probably isn't going to care when facing ruinous legal fees, fines, or even jail time. And those are the consequences.

<comment><USER2> What handshake agreement are you referring to? There's usually no agreements with them at all. A lot of the companies in that list are notoriously litigious. If this was such a risk, why is nobody getting C&D'd? I helped manage one of the larger software security firms in the country, staffed with people using their bench time to do independent assessments of random things that interested them. I can count on zero fingers the number of people who were ever threatened with a suit. What's the evidence that this is a real problem? To me, the evidence loudly suggests that it is not.

There are people who have legit legal issues with the research that they're doing. They fall generally into two buckets:

* The rapidly shrinking bucket of people doing content protection security research for vendors that don't want copy protection stuff broken (and related stuff, like jailbreaking consoles).

* People who are testing _other people 's computers, not their own_.

Most of the legal drama you see in our field comes from that second group. I fully agree: it is legally dangerous to test software running on a stranger's computer without authorization. But most important vuln research doesn't set off that particular tripwire.

<comment><USER5> Often, the drama involves unauthorized testing of websites. Hard to test those on your own computer.

<comment><USER2> There was a thread a couple months back from a story where a tech reporter went out of his way to find (and solicit) stories of legal threats to vulnerability researchers. He ran his best examples in the story, and they were all flimsy. Here's a comment I wrote for the thread:

[https://news.ycombinator.com/item?id=16642155](https://news.ycombinator.com/item?id=16642155)

(This is about the Zack Whittaker story referenced on the thread, not about Dropbox's VDP, which is the ostensible subject of the thread).

Again: these are the _good_ examples.

In the 5 months since, I haven't see more legal drama for vuln research (again, despite multiple huge conferences with people dropping zero-day on litigious vendors on stage). Where is the evidence that this is a real problem?

<comment><USER5> What are your thoughts on the prosecution of Eric McCarty?

<comment><USER2> I don't have any; that case is 12 years old. I'd have to log into PACER to get the indictment and read it.

(I couldn't help it, I got nerdsniped, but the case is also under seal and none of the documents available are interesting).

<comment><USER5> Has the law changed since then? As far as I know, it hasn't.

I think you're right that companies and prosecutors are generally tolerant of security researchers doing their thing.

But I also think the EFF is right that dangerous tools exist that can be misused by overzealous or malicious prosecutors.

<comment><USER2> That's not my claim. I'm saying that lots of companies _aren 't_ tolerant of security research, and, despite their best efforts, still can't do much about it, because as long as you're not reaching out and probing their website, they can't do anything about it.

<comment><USER5> > as long as you're not reaching out and probing their website

I think that's the part the EFF is concerned about. At least the CFAA part.

The EFF also discussed the DMCA, but I'm not familiar with any cases of security researchers prosecuted under that law.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> Ok so I do appreciate the EFF's zeal in preemptively quashing a bug-hunter- hunt, but here's a scenario that throws their thesis into question:

Bank of 'MURICA (Bo'M) gets a phone call from some random guy (Jack) who identifies a bug in the interface between PoS systems at gas stations across the US, and whatever Bo'M internal software-mega-structure manages checking acct balances for Bo'M customers. Now, Jack is a good Samaritan; he would never use this information to steal from millions of Bo'M customers...but like...he totally could. Jack's sister Jill overhears her brother's conversation with Bo'M's security team, & decides everyone needs to know immediately about Bo'M's negligence.

Lets pretend it's going to take a ~month to fix the interface.

Is it cool for Jill to get on Reddit and post the code necessary to exploit the bug before Bo'M has a chance to protect their customers?

Is this a victimless act? Was she just being responsible? Should she have waited to be responsible?

<comment><USER7> Okay, but what about potential customers of BoA that have no idea that the bank they want to entrust their money to has a huge known exploit that increases their chances of identity theft? Does the customer not have a right to know what they are signing up for?

<comment><USER2> I have bad news for you. I don't know what bank you use, but I know this: your bank has huge exploits that increase your chance for identity theft.

<comment><USER7> I'm sure it does. Even if I already was a BoA customer in this theoretical scenario, I would also prefer to be in the know to avoid that specific POS/gas station company until the issue was resolved, instead of wondering why my identity was stolen and dealing with the fallout with my bank unknowingly to blame.

<comment><USER2> You'd be in the know about one random thing, but there will be dozens of others, many of them also known to different subsets of people.

I'm not making an argument about the public policy of disclosure. My view is: if you come about the information lawfully, publish whenever you're ready.

</comment></comment></comment></comment></comment><comment><USER8> This is obfuscating the law. It's not illegal to disclose anything, it's illegal to hack (in certain circumstances). Nobody is getting prosecuted for disclosure, they're getting prosecuted for hacking.

Now, maybe those forms of hacking should be legal. I'm sympathetic to their cause. But it's disingenuous to frame this as disclosure being illegal.

As a side note, the post implies companies are using criminal sanctions as a threat to prevent disclosure - this is itself illegal extortion.

<comment><USER9> If I buy a Bluetooth SmartLock, is it illegal for me to to attempt to open my own lock without the key to see if the product actually works?

<comment><USER2> Almost certainly not (if the lock somehow phones home to a central server and your research involves subverting the server, you could have problems, but no lock I know of works that way).

While it might not be _illegal_ to mess with a lock you've purchased, it could be _unlawful_ , in the sense that you might be violating a contract that you agreed to when you purchased the lock. So while I would stake money on you not getting _arrested_ for doing that work, I wouldn't bet against you getting _sued_ , which is a far more common occurrence. Researchers getting _arrested_ : rare. Researchers getting _sued_ : a little less rare (still pretty rare).

<comment><USER10> >>...but no lock I know of works that way).

And if the law is followed, you never will know of one.

That is the problem.

<comment><USER2> I don't think this is the case. Not only are there probably no locks that work like this on the market, but it is even less likely that, were one to exist, it would be impossible to discover the remote server connection without probing the remote server. Remember also that the law we're talking about isn't strict liability; you have to knowingly exceed authorization.

I've spent the last 13 years doing this kind of work, and bumped into a lot of remote servers I don't own on assessments of devices. There've been a lot of times where I wished I could go further, but never a time where I accidentally got sucked into hacking someone else's computer by dint of probing my own device.

</comment></comment></comment></comment></comment><comment><USER11> That's fine. If Congress illegalizes speech of this nature, then public disclosures of exploits and other code errors won't happen nearly as often.

So what would happen then? There's many, many organizations that are willing to pay for exploits, because they plan to use them. There's one such company in DC that is likely to sell to the defense industry. For a 0-day no click exploit, $500k .

So sure, make it illegal. You only push this into the illegal side of operations and exploits. And I would much rather have exploits well known, so I can make the determination to: do nothing, take service down until fixed, or try to patch if available.

<comment><USER12> >> For a 0-day no click exploit, $500k .

Which company is that again? You hang around with them cybersec folks too long and you keep hearing about these 6 or 7-figure payouts for expl0its by some mysterious companies.

But it's always someones friend or friend of friend or some other 'reliable' source.

Can someone here actually say that they have received, or more importantly, are on a consistent basis getting 6-figure payouts for their exploits?

For reference, Microsoft offers bug bounties up-to $250k[0]. I can see that in light of this, it's not entirely unreasonable that some tax payer money has been wasted on buying an exploit or two for large amounts of $$$. But what I am calling into question is the myth of consistent 6/7-figure payouts for 'exploits' when sold to 'shady' companies or that such payments would be common place or such markets being generally available to security 'researchers' (read exploit developers).

Intrigued to be proven wrong here! :)

[0] URL: [https://www.microsoft.com/en- us/msrc/bounty](https://www.microsoft.com/en-us/msrc/bounty)

<comment><USER13> [https://zerodium.com/program.html](https://zerodium.com/program.html)

This is fairly vague, and "up to $X" butnpossibly provides a touch more concrete-ness than you've seen so far.

You're right though; you won't find anyone who is currently selling 0day exploits to brokers or govt who will be willing to go on record. Or even admit that they sell them.

<comment><USER12> Thanks for this link. It looks like my skepticism may not have been well founded. Are there [many] other similar companies out there? Now that my curiosity peaked, they are the only one mentioned in Wikipedia[0] related to this activity.

And as an add-on question to satisfy my curiosity, how would one know when approaching company such as one linked here that the exploit sold will be used by good-guys<tm> and doesn't come to haunt you later when it ends up being used by bad-guys<tm>?

[0] [https://en.wikipedia.org/wiki/Market_for_zero- day_exploits](https://en.wikipedia.org/wiki/Market_for_zero-day_exploits)

<comment><USER13> disclaimer: I haven't sold a single exploit, so am taking a few guesses here. Approx ~5 of my relatively close friends are exploit devs, and most of them don't talk about anything beyond the name of the company they work for.

There aren't a ton of companies, but once you've worked in the general offense industry, names start to reappear regularly.

I'm not sure what your definition of good/bad guy is. If you don't like the idea of 0day used for "cyber warfare" then it's easy: only sell directly to the vendor. If your idea of good guy is your own nation, you can usually tell a companies alignment. They'll have an ex-NSA CEO, or close partnership with a defense contractor. Ultimately you're never sure though.

Edit: I'll also add that in your earlier post you mention the high cost, and wasting of taxpayer dollars. I don't disagree, but an interesting way to look at it is value per dollar. If you look up the cost of running a state of the art attack helicopter or even just a couple of hummers loaded up with navy seals and all their kit, you find that dropping a $1m piece of remote Jailbreak malware on a bad actor is actually really amazing ROI in terms of finding out what your enemy is upto, and disrupting their plans.

</comment></comment></comment></comment></comment><comment><USER14> There are a large number of penetration testers that operate in the open because it is legal and there are frameworks for disclosure. What happens when we make this illegal? Will those people simply cease and desist?

</comment><comment><USER15> This is easy to get around. Just release the information anonymously on an anonymous platform.

<comment><USER16> Yea but most platforms, that garner any attention, are not actually anonymous in ways that would protect the person releasing the information.

<comment><USER13> The full-disclosure mailing list has been around 20 years and has no problem garnering attention. Sending an anonymous email in that direct with no way to track back isn't particularly difficult.

</comment></comment></comment><comment><USER17> Attempting to have a reasonable conversation in this thread is impossible because mods have allowwed _certain_ accounts to post as much as they want and brigade counter opinions.

<comment><USER18> Most accounts are allowed to post as much as they want! We do put rate limits on some if they have a history of posting too many low-quality comments too quickly, or of getting involved in flamewars. Also, new accounts are rate limited for a while, to cut back on trolling.

If you or anyone else has a rate limited account and would like us to lift the rate limit, you're welcome to email us at firstname.lastname@example.com. We're happy to do that if we believe there's an intention to use HN as intended in the future.</comment></comment>


Ask HN: Did obtaining an AWS Solutions Architect certification help you? - <AUTHOR> And if it did, was it because of what you learned during the training or because of the certification itself? <comment> pickle-wizard I hold the AWS Solution Architect Associate certification. I had a lot of fun studying for the exam, and learned a lot.

However it did not help me one bit in looking for a job. Everyone wanted someone with experience.

My certification expires in November and I'm not going to renew it. I've decided that I'm going to work on getting an advanced VMware certification. There is still a lot of on prem out there, and I have 15 years of experience with VMware. So figure I should leverage that.

</comment><comment><USER2> Most certifications are a scam in my opinion - if your employer wants you to get one and is paying for it then ok, but I would never spend my own money on a certification. A couple years hands on in an AWS environment and you'll be an old pro.

<comment><USER3> Typically you will gain deep, rather than broad, AWS experience from your job because only certain stacks and configurations are used repeatedly.

Self-study and experimentation are viable routes to augment professional experience but some prefer to learn from curricula.

</comment></comment><comment><USER4> In general, the value of any certification is inversely proportional to how many are awarded. If they are easy to get and lots of people have one (think liberal arts diploma), they're not worth much.

For comparison purposes, you might look at other similar proprietary technical certifications that have been in the marketplace longer --- for example, RHCE or MCSE (now defunct).

<comment><AUTHOR> Not really sure about that. I know for a fact that many companies ask about just to be able to bypass the interview part about AWS.

<comment><USER5> The question, if you have the luxury of asking it, is do you want to sign away a big chunk of your life to one of these companies?

<comment><AUTHOR> Can you elaborate? Why a big chunk of your life?

</comment></comment></comment></comment><comment><USER6> People often ask me if gaining a certification like the AWS Certified Solutions Architect Associate is enough to get them a job. The short answer is that an AWS certification alone will not get you a job. There are several other attributes that play an essential part in kick-starting your AWS career. I think it's also fair to say that AWS certifications are almost prerequisites, rather than differentiators today. Unless you have several AWS certifications, this is usually the case. Everyone seems to have their Solutions Architect Associate certification so that's not going to make you stand out when applying for an AWS Solution Architect job.

</comment><comment><USER7> I got mine with very little studying, I happened to already be working within a lot of AWS tooling and knew some general cloud architecture concepts, so in my case it was more of a validation tool.

So far it's hard to tell if it has helped with anything. I might have gotten a look for an interview with it. But that's hard to say, companies don't usually tell you what resume items made them interested.

I would imagine it would make sense to get one if you want to work for Amazon, or maybe another big company that likes certifications. I don't know that it would help elsewhere.

Try to get your company to pay for it!

<comment><AUTHOR> What level was it?

<comment><USER7> I got associate and then professional a couple months later. I studied for neither beyond maybe an hour of looking at what the question formats looked like.

I figured that it was a better use of time to study only if I failed, and then re-take, since there's no punishment for failure other than cost.

I barely passed professional, but I passed. Associate felt easy for me.

I have about 2-3 years experience working just about 100% within AWS for my job. I would think that both exams would be way harder and require study without so much practical experience.

Maybe an AWS certification could help you if you lack experience in your resume and want to land a cloud engineering role.

Also, if you're paying yourself, as of a few months ago it seems like Amazon gives you a 50% discount code for your next exam every time you take an exam. In other words, only the first exam is full price. I couldn't guarantee that this offer sticks around or anything.

<comment><USER8> Do you use Terraform? I'm just wondering because I interact with AWS 90% (possibly more) via Terraform. I rarely use the AWS Console and have never looked at Cloudformation or eksctl. I wonder if that's gonna make the certification more difficult for me...

<comment><USER7> Yes I do the same! Almost entirely through Terraform.

In no way does that hurt your knowledge! By doing everything in code you probably understand a lot more to begin with, since you don't rely on some of the UI crutches and defaults.

Honestly I check the Terraform documentation before I even bother with AWS docs 99% of the time.

The system architect questions are definitely more high level architecture questions that revolve around understanding the AWS products and what trade- offs you make by choosing one of the the other.

Like any other multiple choice test, much of passing the test revolves around general test taking strategies (e.g. reading carefully and eliminating wrong answers)

I'm sure you'll get the gist of it from the example questions that are out there (Amazon also has a few for free).

Understanding a few things about less commonly encountered products like Kinesis could help, too.

</comment></comment></comment></comment></comment><comment><USER9> I find certificates help when the person hiring you does not know enough about the topic. As such they use your certificate as a crutch to confirm you know something about the topic. It will also be used by recruiters to sell you, once again to people who do not understand the tech enough to properly evaluate you.

A certification might also get your resume past HR and to the hiring manager.

</comment><comment><USER10> I don't have the Solutions Architect certification but I do have the AWS Certified Developer certification. I learned quite a bit during the training and it did help me get a job, though it's hard to quantify how much as I've also been in IT/IS for nearly 15 years which includes 10 years of software development experience. I also get contacted fairly regularly by recruiters who see I have the certification listed on LinkedIn.

</comment><comment><USER11> Yeah it helped me. I don't think it really helped me get a job. I think my CV and past experience was taken far more into account than any certifications I listed. However, it helped me to become familiar with some of the aspects of AWS that I didn't use in my day to day job and also to solidify my understanding of some other areas. I don't regret studying and passing it especially as it didn't cost much.</comment>


Thinking Functionally with Haskell – Richard Bird's New Book - <AUTHOR> http://www.amazon.com/Thinking-Functionally-Haskell-Richard-Bird/dp/1107087201/

<comment><USER2> For those of you who aren't familiar with the author's other works, it's worth taking a peek at his other books.

I can whole heatedly recommend Pearls of Functional Algorithm Design [http://www.amazon.com/Pearls-Functional-Algorithm-Design- Ric...](http://www.amazon.com/Pearls-Functional-Algorithm-Design- Richard/dp/0521513383)

It's a good cross between two other excellent books:

\- Jon Bentley's Programming Pearls [http://www.amazon.com/Programming- Pearls-2nd-Jon-Bentley/dp/...](http://www.amazon.com/Programming-Pearls-2nd- Jon-Bentley/dp/0201657880)

and

\- Chris Okasaki's Purely Function Data Structures [http://www.amazon.com/Purely-Functional-Structures-Chris- Oka...](http://www.amazon.com/Purely-Functional-Structures-Chris- Okasaki/dp/0521663504).

If you haven't read all three, its well worth your while to do so!

And of course if you are going down the rabbit hole of reading Perls of Functional Algorithm Design then you need to read the "how to read Pearls of Functional Algorithm design" as well.

[http://www.atamo.com/blog/how-to-read-pearls-by-richard- bird...](http://www.atamo.com/blog/how-to-read-pearls-by-richard-bird-1/)

<comment><USER3> Seconded! Also, I'd highly recommend "Introduction to Functional Programming using Haskell" by the same author. This was the book that set me forth on the path of FP during post graduation. Though, professionally, I've been programming in Java for close to a decade now most of the FP principals have held me in good stead.

[edit] Preface says "The present book is a completely rewritten version of the second edition of my Introduction to Functional Programming using Haskel" so my recommendation is moot.

</comment></comment><comment><USER4> Richard Bird was my lecturer at university - Intro to functional programming was on the pre-university required reading list... We were told to buy our professor's book before arriving.

Turns out it was an excellent course, and Haskell is a great intro to programming in general, but the book? Think I sold it back via Amazon in the first term.

Haven't read this new book, but $90 seems like a price set to be sold to university libraries, not students - surprised to see it on the HN homepage.

</comment><comment><USER5> I'm contemplating buying this, but I won't let myself until I feel like I've done all the exercises in "Beginning Haskell"[0].

0: [http://www.amazon.com/Beginning-Haskell-A-Project-Based- Appr...](http://www.amazon.com/Beginning-Haskell-A-Project-Based- Approach/dp/1430262508)

</comment><comment><USER6> Looks like an updated version of his 1998 book "Introduction to Functional Programming using Haskell":

[http://www.amazon.com/Introduction-Functional-Programming- us...](http://www.amazon.com/Introduction-Functional-Programming-using- Haskell/dp/0134843460)

The 1998 book was excellent, except that it came just before Haskell 98 and so one or two examples needed a little modification before they would build with GHC, but really it was a paper and pencil type of thing. I read the whole thing sitting in a copyright library without a computer because the book was two expensive to buy and was not in my university library. Looks like that won't change with this update.

</comment><comment><USER7> What is this book's specific niche compared to all the other Haskell books out there?

<comment> T-R Just taking a quick glance through the table of contents, it looks like it aims to focus more on "how to think about problems in this paradigm" (as the title implies) than the more practically-oriented "let's go write fizz-buzz" approach. For example, it jumps into function composition before it even talks about how to use GHCi. It has a chapter called "Proofs", and it seems to have a chapter focusing on using lazy evaluation to trade off time and space consumption.

Glancing at the text available, it doesn't seem to make any references to other programming languages, and takes an approach of "let's build this up from the things you learned in Math class". Seems like it might be a good fit for someone with more math than programming background, or someone with enough programming experience that they want to get to the heart of what functional programming is, but a bit jaded by the usual language tutorial format.

</comment></comment><comment><USER8> If you're signed up to the edX FP with Haskell course you can get Graham Hutton's book "Programming in Haskell" 20% off.

</comment><comment><USER9> Ok, I'm not a big fan of ads here at Hacker News, but actually you kind of proved me wrong as I'm genuinely curious and very tempted to give it a try :-). It looks like a book that could help me become a better dev. I'd probably be using FP via F# at the end of the day, but it's more about the FP mindset, that I think I still don't have.

Anyway, buy it somewhere else! (I will do ...). I know, Amazon is super cheap and convenient, but we need competition and diversity.

</comment><comment><USER10> 50 USD is too expensive for me, Even the kindle edition is 1k INR. Sorry too poor :-(

<comment><USER11> The functional and Haskell hype is on the decline. You don't miss much.

</comment></comment><comment><USER12> Hmm Amazon says "This title has not yet been released"

<comment><USER13> The Kindle edition, at least, is available now. Bought it earlier this week and it's been great thru the first couple chapters.</comment></comment>


Autofill abuse allows websites to grab sensitive userdata - <AUTHOR> http://board.protecus.de/files/autofill-abuse/demo.html several browser, leak vcards and userdata through their autofill feature - i am happy about any support and comments! <comment><USER2> This raises another issue I have been concerned with for a while. The WWW model is broken, namely the use of Javascript. I'm not talking about the language itself, it has been getting enough love lately as it is. Just the idea of a webserver sending me code, obfuscated code at that [1], that my browser executes by default; how did this idea prevail on the web, I wonder. Am I the only one to see the horrendous security flaw? "Come to my website, I'll distract you with my pretty pictures while my code roams freely on your computer[2]".

[1] - I know obfuscation is minification meant for minimizing bandwith consumption. It's still obfuscated code, despite best intent.

[2] - I understand that the code execution is sandboxed inside the web browser, but really is it at all possible that, you know, these guys let the occasional security flaw slip?

<comment><USER3> Javascript has nothing to do with auto fill

<comment><USER4> You're correct, but the parent brings up a valid (if a bit off topic) point.

Eye candy is great, but Javascript has often been a vector for privacy issues. Hence the popularity of Noscript and most browsers having an option to disable Javascript.

</comment></comment></comment><comment><USER5> Stopping autofill of hidden fields is easy and must be done.

To truly fix this bug, though, it would be nice to also stop autofill of technically "visible" fields that are tiny or under another object or otherwise obscured. But that might be orders of magnitude more difficult.

</comment><comment><USER6> well, at least it requires explicit user action.

If I enter my real name somewhere, I'm probably fine with providing my phone and post address, too. When in doubt I use a fake identity.

what about chrome's credit card autofill?

<comment><USER7> I always wondered about this. Also, wouldn't it be really easy to have a form pull autofilled CC info via ajax without even needing the user to hit submit?

<comment><USER8> I was just wondering the same thing, using the onchange action.

<comment><USER9> If I'm remembering correctly, Chrome's autofill doesn't fire change events for the fields. Has annoyed me from a developer standpoint at times, but the reason behind it is valid.

<comment><USER10> Though to grab this info with ajax it doesn't have to fire off an event when the auto-complete changes it. It could just check every second itself if the form changed and if so send off the info.

</comment></comment></comment></comment></comment><comment><USER11> Same problem happens with Lastpass (which at least requires you to click the fill form button, rather than auto populating the fields).

</comment><comment><USER12> One workaround for this in chrome is to remove name/email values from address auto-fill form, so it will only populate when you actually enter address. And it's generally good idea to separate general browsing from personal/finance/etc using user profiles.

</comment><comment><USER13> Using Chrome 18.0.1025.151 and it doesn't seem to be susceptible to this.

<comment><USER14> Same build here (on OSX 10.7.3) and it does indeed pre-populate the hidden fields for me.

</comment></comment><comment><USER15> Nice find - you've noticed important threat. However on my Chrome (despite having autofill swithced on) your demo doesn't work.

<comment><USER16> It, sadly, does on my install of Chrome (18.0.1025.113 beta) - Linux 32 bit.

<comment><USER17> You probably want to upgrade to the .151 version, which fixes other vulnerabilities as well.

<comment><USER18> I'm on that version (18.0.1025.151) on OS X 10.7.3 and the vulnerability was present for me.

<comment><USER17> And after I wrote the above comment, I tested it and I am as well, on Linux.

The fun thing about this type of vulnerability is if you know the user's name, you can build an invisible form component to get the browser to spill the stored password.</comment></comment></comment></comment></comment>


Dutch court rules that virtual items can be stolen just like physical ones - <AUTHOR> http://massively.joystiq.com/2012/01/31/dutch-supreme-court-declares-runescape-theft-a-real-world-crime/

<comment><USER2> I wonder if this is setting some kind of precedent to MAFIAA claims in future</comment>


Neural Turing Machines (2014) - <AUTHOR> https://arxiv.org/abs/1410.5401 <comment><USER2> Interesting. Reminds me of old attempts on using NN's or ML techniques to derive programs from data kind of merged with fuzzy-logic controllers. Here's two links from the analog, Turing-complete NN's they cited in the paper:

[http://binds.cs.umass.edu/anna_cp.html](http://binds.cs.umass.edu/anna_cp.html)

[http://research.cs.queensu.ca/home/akl/cisc879/papers/PAPERS...](http://research.cs.queensu.ca/home/akl/cisc879/papers/PAPERS_FROM_MINDS_AND_MACHINES/VOLUME_13_NO_1/J7L1675237505M16.pdf)

It would be interesting to see designs like theirs and others we see posted trained until they got really good at application area, then synthesized into digital or analog NN implementations with plenty of resiliency. The components are so simple they can run with few gates or other components. Anyone studying NN's know what current state of the art is for synthesizing efficient HW from a given NN model? With or without ability to continue to learn/improve.

<comment><USER3> There was work done by Doug Burger from microsoft, spliting an algorithm to between a digital Cpu and a neural compute unit(simulated in analog). In algorithms that we're not bottlenecked by the digital cpu, they've even seen gains of 50x in perf/w.

But most algorithms they tested we're bottlenecked by the digital part, so the average benefit was ~3x.

But maybe if you start the design using this "turing neural network", you could see consistently large gains.

</comment></comment><comment><USER4> Is it just me or is anyone else bothered by the lack of theory here? The results are great, but seem so heuristical and ad-hoc, like somebody tried lots of things and one seemed to work, but there's no clear idea as to why, and certainly no general theory tying things together.

<comment><USER5> I can't speak to the RL methods used here, but wrt to the architecture they designed, I think it might seem less ad-hoc if you know that generally speaking new neural net architectures work well when they

1) can do some useful computation

2) with a good loss function

3) with a small number of parameters

4) in a differentiable way

5) where the gradients can flow

So for instance LSTMs are better than RNNs due to (5), convnets are good due to (3), etc.

<comment><USER6> You've just numbered 5 different rules of thumb... That hardly supports your idea that things are not adhoc.

<comment><USER5> Firstly, (1) and (2) are not rules of thumbs for building nice architectures, but basic properties about supervised learning and what kind of problems it can solved.

Even if it were 5 rules of thumb instead of 3, "design an architecture to satisfy 5 rules" is a lot less ad-hoc than "somebody tried lots of things and one seemed to work", which was what I was replying to. We also know why each of these rules are important.

<comment><USER6> I'll concede that 1) and 2) are basic properties that an educated layperson would understand after reading a few ML blog posts. Hardly a working theory of neural nets.

They're still rules of thumb. You've argued that they are less adhoc than if they didn't exist. That's misses the point: that is still enormously adhoc.

</comment></comment></comment></comment></comment><comment><USER7> funny, i was just reading this article on medium, about NTM [https://medium.com/snips-ai/ntm-lasagne-a-library-for- neural...](https://medium.com/snips-ai/ntm-lasagne-a-library-for-neural- turing-machines-in-lasagne-2cdce6837315#.owfvji1oy)

<comment><USER8> Thanks for sharing, very nice article indeed. Looks like the guy works here --> [https://snips.ai/](https://snips.ai/). Their product looks promising and branded as an "intelligent memory", would be interesting to know if they're using an NTM implementation in their product.</comment></comment>


Interesting example that tech is moving a bit too fast - <AUTHOR>

As we are all technologists, this is a hard thesis to contemplate. But I've been thinking about the idea that technology might be evolving too fast for even technologists to keep up.
A case in point: I've been following a MEAP (access to chapters of a book before it is published, great idea IMHO) on the Play Framework. I came across this post:
http://www.manning-sandbox.com/thread.jspa?threadID=61845&tstart=0
The authors, presumably experts on the Play Framework, got blinded and a part of the book became somewhat obsolete before it was even published! This is not a criticism of the authors at all. Frankly, I am excited to buy a copy of their physical book when it comes out in January. My point is that when projects (not this book but actual development projects) make technology decisions using the shiny new thing, they need to have a tacit path as to what to do when the hot thing goes out of style and becomes unsupported. I've seen this happen many times in my career and the pace of obsolescence seems to be getting faster. <comment><USER2> Thank you Mr. Kaczynski. Why not use a typewriter? :)

<comment><AUTHOR> Lol! I can't live without access to HN. My wife calls it my mistress.</comment></comment>


The Importance of Aligning Authority with Responsibility (2010) - <AUTHOR> http://blog.jbrains.ca/permalink/the-importance-of-aligning-authority-with-responsibility <comment><USER2> This brings back nightmares I had from working at Microsoft (2009).

As a PM; responsibility without authority was the job description. Hallway estimates and schedule chicken was 70% of the job. And the there was stack ranking...

</comment><comment> awinter-py No argument that reliable estimation is hard.

I think organizations that find conflict at the estimation stage are actually suffering from a shortage of design. For complex projects, design means R&D, and setting deadlines based on unfinished research can lead to failure or ballooning schedules.

</comment><comment><USER3> this is why i stopped accepting "delegation" [of responsibility of course as it has never been delegation of managerial authority and salary/bonus] from my managers long ago :)</comment>


Review: System76's Galago Pro Solves "just works" Linux's Goldilocks Problem - <AUTHOR> https://arstechnica.com/gadgets/2017/08/review-system76s-galago-pro-solves-just-works-linuxs-goldilocks-problem/ <comment><USER2> I find it interesting that the review prefers this over the Dell XPS 13/15, given that:

\- the XPS is thinner and lighter

\- the XPS has a much smaller bezel

\- the XPS has much better battery life

It seems like those qualities would put it closer to being the "Linux Macbook Pro" than the Galaga. Is it just the amount of raw power that the Galaga has which puts it over the top in his book?</comment>


GitHub Updates Privacy Statement - <AUTHOR> https://github.com/blog/2239-updates-to-our-privacy-statement <comment><AUTHOR> > we don't let third parties track you on GitHub

I thought that meant that Google Analytics would be gone ... it's still there though.</comment>


Should we include programming on early education curriculums? - <AUTHOR> http://trendguardian.blogspot.com/2010/06/fast-tracking-alternatives-to-college.html

<comment><USER2> I an rapidly reaching the conclusion that it doesn't matter _what_ you teach the kids, as long it is taught well by somebody who understands _and_ loves the subject.

Because what you _really_ want to teach is the ability to learn from the best.</comment>


Ask HN: Who are the best engineering recruiters you've worked with, and why? - <AUTHOR>

Let's face it - 90% of recruiters are pretty awful. Who are the best ones you've worked with? Why are they exceptional? Especially curious about independent recruiters! <comment><USER2> Aline Lerner. She used to be an engineer and she gets us. [http://blog.alinelerner.com/](http://blog.alinelerner.com/)</comment>


Ask HN: What should I teach a class of low-income kids about programming? - <AUTHOR> Wednesday, I'm speaking to a group of inner city kids about software engineering and have been moderately stressed about what I should tell them. I feel that this is a great opportunity to reach out to my community and I don't want to waste it. What are some talking points that you would focus on?<p>EDIT: These are middle-school aged kids. <comment><USER2> I've done this in Chicago. You didn't specify their ages, I'm assuming these are high-school kids. The important point to stress, I think, is that computers and programs are all around us, and not just as computers, either. Ask them to name a computer they use daily, then surprise them with the usage in dishwashers, cars, etc. (these are more microcontrollers but the distinction is not important).

From there you can go to the theme of "be a programmer of be programmed", i.e. everybody needs to know _some_ coding. Tell them that math is not a prerequisite (a usual worry about programming) and show them some cool but simple game programming examples using Scratch, pygame and the like. In fact, it would be great if you can create a game _during_ the presentation, with ~10 lines of code.

<comment><USER3> Just out of curiosity, could you provide a link to a simple game written in ~10 (ten!) lines of code? My understanding was that for anything close to interactive game at least 50-100 lines of code are needed: to draw something, make it move and react to user input in a meaningful way.

I am not familiar with frameworks such as Scratch or pygame; still 10 lines of code look like too few for a game.

<comment><USER4> You can do a simple terminal program in 10 lines. 10 commands probably not, but this is still fairly readable. in perl, a simple guessing game that runs in linux/unix

#!/usr/bin/perl $SIG{ALRM} = \&timesup; my $random_num = int (rand(10)); print "Guess my number (0-9) in less than 10 seconds!\nGuess: "; alarm 10; while(1){ my $guess = <>; if ($guess == $random_num){alarm 0;print "You Got it! Well done!\n"; last; } else { print "Nope; guess again: ";} } sub timesup {die "Uh oh! Time ran out while waiting!\n";}

</comment></comment></comment><comment><USER5> How cheap and easy it is to get into web programming. Everything they need (except a computer and an internet connection) is free. And the fact that there'll be plenty of jobs in software/web for the foreseeable future. And that it's fun and they can pwn their mates.

Maybe throw in a focus on mobile development too - I'm always amazed at how many low-income kids around here have smartphones.

<comment><AUTHOR> I definitely want to focus on the accessibility. I came from similar roots and would likely not be in the career I am today if not for the low barrier of entry.

</comment></comment><comment><USER6> A friend of mine here in St. Louis is starting a non profit that does just this. They have started by having hack-days (with Arduino and other DIY projects), pop-up tech classes, and tours of local startups.

<http://thedisruptiondepartment.org/>

His name is Gregory, feel free to ping him for thoughts or advice.

</comment><comment><USER7> I teach high school math and science to at-risk students, and I teach an intro to programming class when I can. I have heard numerous stories of smart kids who realized in middle school that they wanted to be programmers. It often falls along the lines of "I noticed that all of my peers liked playing games, but I was more interested in how you make games."

These students often spend years chasing different leads about how to follow up on their interest. All of the software tools needed to dive into programming are free, but the ecosystem is really hard to navigate if you don't know anyone who is aware of current professional programming practices. Many "computer science" teachers do harm to these students by directing them to dead-end languages on old school-district-based Windows systems. I don't use the term "do harm" lightly, either. I have seen numerous examples of young people who have built up serious resentment towards education in general because of their frustration in dealing with teachers who know less than they do.

/rant

Here's what I'd suggest: \- Look for the students with a spark in their eye. See if you can pick out which ones already know they want to be good hackers. \- Map out their next few years of learning, so they know what to focus on. \- Tell them to learn Linux. Tell them that if they can find a beater laptop, download a distro, and load it, they can have functioning computers their whole lives. Low-income students have a difficult time maintaining Windows computers at home. If they can build a linux box, they can take charge of hardware issues. \- Tell them to learn python. The community is incredibly supportive of non-traditional programmers, and the language leads you to whatever kind of actual work you want to do in programming. \- Last, and most important: if you can do a followup visit two weeks or one month from now, your impact will be deepened. Ask the students which of them have tried to follow up on your talk. Those are the students who need your support. Just act as a guide for them; help them find a beater laptop, help them get a distro running, help them run an interactive shell, point them to some learning resources. \- If you really want to make a difference, keep visiting every 2-4 weeks so these students spend minimal time lost in the programming ecosystem.

In closing, thank you for doing this. There are incredibly smart kids in low- income areas, and many of them have a strength in them from dealing with adversity. If we support them, they can channel that strength towards very meaningful work.</comment>


Show HN: Serve – instant, backgrounded local file serving - <AUTHOR> https://github.com/benvan/serve <comment><USER2> That's nice, but it isn't clear: does this thing daemonizes itself, it is installed as a service or something like that?</comment>


When The Apple II Was New - <AUTHOR> http://apple2history.org/2014/06/11/when-the-apple-ii-was-new/ <comment><USER2> I had a wonderfully tricked out Apple II as a kid:

• Videx enhancer providing lowercase capability.

• Apple II Plus ROMs providing Microsoft basic. The original II Integer Basic ROMs were in an Apple language card in slot 7 with a toggle switch to activate the original ROMs.

• 64K RAM, the extra 16K provided by a Microsoft language card in slot 0.

• Epson MX 100 via serial card in slot 1.

• Novation Applecat in slot 2.

• Videx 80 column card in slot 3.

• Microsoft CP/M card in slot 4, because Wordstar.

• Disk ][ card in slot 6, attached to a pair of Disk ][ drives, modified with an external toggle switch to enable/disable writes, because hole punch argggh.

• Video output to both an Apple Monitor /// green screen and to Sony 13" Trinitron TV.

<comment><USER3> Nice! I had a Franklin ][e clone at home while I was in high school, and then a real Apple ][e at work (during college). We built control cards that would connect to an external box (via opto-couplers!) which could drive stepping motors. Originally these were smaller motors, but eventually the drives included systems that could run milling machines, lathes, etc.

One nice thing is that the bus was easy to deal with. Clock speeds were low (all were back then) and the gold-plated edge fingers were (comparatively) big, so you could design a card that just plugged in.

<comment><USER4> The large size of the components and connectors was a unrecognized virtue -- you didn't need a microscope and surface-mount soldering station to throw something together. All you needed was the prototyping card, and some wire- wrap IC sockets.

</comment></comment></comment><comment><USER4> Loved my Apple ][+ -- best computer ever because it was expandable and simple.

I bought the computer itself from a summer job I had, and dad bought the Disk ][ drive and the cheap B&W TV we used as a monitor. Later on I added an 80-column card and a RAM upgrade to take it to a bank-switched 64k.

There were hard drives for sale at the time - Corvus sold a 5mb unit for $4900. Way out of my price range, and how could you _ever_ fill that much space up? :)

<comment><USER2> I remember drives were crazy expensive but that seems high. Supposedly you could get the 10 MB Sider for $700 in late '85:

[http://apple2.org.za/gswv/USA2WUG/FOUNDING.MEMBERS/HOME.PAGE...](http://apple2.org.za/gswv/USA2WUG/FOUNDING.MEMBERS/HOME.PAGES/EDHEL/sider/)

<comment><USER5> The Corvus was 10 Megabytes for $5,350 in 1979. $4,900 for 5MB seems plausible.

[http://www.vintagecomputing.com/wp- content/images/retroscan/...](http://www.vintagecomputing.com/wp- content/images/retroscan/corvus_apple_large.jpg)

</comment></comment></comment><comment><USER6> I learned to program (BASIC, of course) on an Apple IIe. I was in elementary school. One of my classmates' moms was a professional computer programmer, and came in to teach us all to program. I can't imagine how different my life might be now if she hadn't done that, and if the Apple hadn't been such an easy and fun platform to play with.

</comment><comment><USER7> Google's cached version

[http://webcache.googleusercontent.com/search?q=cache:XVk3yBR...](http://webcache.googleusercontent.com/search?q=cache:XVk3yBR1dv0J:apple2history.org/2014/06/11/when- the-apple-ii-was-new/+&cd=1&hl=en&ct=clnk)

</comment><comment><USER8> My first computer was an Apple IIe with the DuoDisk drive, supplemented soon afterward with a then-blazing-fast 1200 bps modem. The Apple-branded one that hung, kinda bizarrely, from the wall. Add an Apple mouse (I recall the hardware took up a whole slot), a Super Serial Card, an Apple 80 column memory expansion card, and it was a dream computer.

That is, at least until the Woz-edition Apple IIgs came along a few years later!

Like someone else in this discussion, I don't know how my life would have turned out if it weren't for the Apple IIe/IIgs. I likely wouldn't have learned how to program, wouldn't have been exposed to those early glimmerings of hacker culture, wouldn't have gone into technology journalism, and wouldn't have left technology journalism to found [http://recent.io/](http://recent.io/). On the downside, unlearning the bad habits of Applesoft BASIC is a life's work! :)

<comment><USER5> Folklore.org has the story of the original Apple ][ mouse. It's a really great hack (in the traditional sense of the word)

[http://www.folklore.org/StoryView.py?story=Apple_II_Mouse_Ca...](http://www.folklore.org/StoryView.py?story=Apple_II_Mouse_Card.txt)

</comment></comment><comment><USER9> The first computer I ever got to see and touch in person was an Apple IIe. My buddy in the Air Force got it, and let me play on it. Wonderful li'l machine. First time I stayed up all night playing a game, text of course.

</comment><comment><USER10> I was so lucky. My dad used to work at Apple in the 80s so we pretty much got every model since the Apple ][+ at home.

Can't remember this too well but I think I started with a ][+ with 2 floppy drives, a Silentype (thermal!) printer and Monitor ///, paddles, joystick, Apple's Graphical Tablet.

And tons and tons of software. Everybody copied. There was no internet, so there was a lot of borrowing and copying of floppy disks.

Learned to program in Basic, 6502, Logo. A little bit with UCSD Pascal. I was a kid and more interested in Captain Goodnight, Karateka and all the wonderful text adventures that I could barely understand in English.

Good times. Maybe time to fire up an emulator and see how much I remember.

<comment><USER11> Good lord USCD Pascal I remember having to stay late at work in the UK to ring the Microsft helpline line in new mexico to try and diagnose a really persistent bug.

</comment></comment><comment><USER12> It was a nice machine, although I never saw one live.

In Portugal, the ZX Spectrum and Commodore 64, followed by their successors ruled the home market.

</comment><comment><USER13> I still have a 1987 Apple //c, with its original packaging and accessories: carrying bag, 9" green monitor, additional Disk II drive, mouse, MouseDesk software and manual, joystick, RGB TV adapter... And of course the original cardboard box, which was already very Apple-looking (white, with fancy, large text and nice, elegant pictures).

</comment><comment><USER14> despite the file systems limitations of apple dos 3.3 it was a pretty nifty achievement

<comment><USER15> Big Bang theory quote -_-

Source: [http://the-big-bang- theory.com/quotes/character/Sheldon/38/](http://the-big-bang- theory.com/quotes/character/Sheldon/38/)

>Sheldon Cooper: You're my 15th favorite technological visionary.

>Steve Wozniak: Only 15th?

>Sheldon Cooper: It's still 6 spots above Steve Jobs. I care neither for turtlenecks nor showmanship.

>Steve Wozniak: Yeah, I never got that turtleneck thing.

>Sheldon Cooper: One of my proudest possessions is a vintage 1977 Apple. Despite the file system limitations of Apple DOS 3.3, it was a pretty nifty little achievement.

>Steve Wozniak: Thanks. We were shooting for nifty. You know if you had it here I'd autograph it for you.

>Sheldon Cooper: Don't move for 15 to 30 minutes depending on how the buses are running.

>Steve Wozniak: (To his wife) Nerds!

:.:.:

Also His 1977 Apple ][ is running Apple Dos 3.3 (circa 1983)?

<comment><USER16> > Also His 1977 Apple ][ is running Apple Dos 3.3 (circa 1983)?

\- 3.3 was originally released in 1980, it was in 1983 that 3.3 received its last bugfix release.

\- Sure, why not! Apple DOS wasn't installed anywhere, it had to be loaded from a floppy at boot. Upgrading wasn't a big re-installation or migration. Running DOS 3.3 isn't any weirder than it playing Donkey Kong (1984).</comment></comment></comment>


What the Google Web will look like in 10 years - <AUTHOR> http://royal.pingdom.com/2009/12/09/what-the-google-web-will-look-like-in-10-years/ <comment><USER2> The article briefly mentions artificial intelligence. Some time ago I was at a lecture by Peter Norvig, Director of Research at Google, where he spoke about AI and AI in regard to Google. They are definitely thinking about it. Google has an army of PhDs, lots of money, petabytes of data and lots of computer resources... I think they will implement something that resembles AI in the next 10 years as it's one of the ways they can improve their search and their ad platform. Currently, Google is doing big leaps into this field already (with Google Translate, Google Voice etc.)

<comment><USER3> agree....google goggles looks like magic to me.</comment></comment>


Ask HN: Coping with impending success? - <AUTHOR>

New account, longtime HN user.
I think I'm about to get called up to the big leagues, and I find myself oddly nervous.  I don't get nervous around the famous/powerful people in my world, but I am, perhaps, a little too used to being a relative nobody, myself.  I'm comfortable with the scrappy underdog role to a fault.  Now my efforts are beginning to bear fruit, and doors are beginning to open to me that haven't been in the past.
I don't want to mess it up.  I need to relax.  I suppose time will tell if I belong at that stratum, but in the meantime I was wondering if any of the more successful readers of HN remember this point in their careers, when they were on the brink of succeeding in a bigger way than they had ever succeeded before.
Can you share what it felt like, how you coped with it, and how you took the opportunity for all it was worth, rather than messing it up?
Any replies appreciated...
----
Edit: Also, even if you're not a superstar, have you ever personally known anyone with a big opportunity, who blew it?  What mistakes did they make?  Or, if you know someone who dealt with their opportunity stunningly well, how did they do it? <comment><USER2> Stay yourself, be genuine. Treat people that you believe are out of your league like you would treat anybody that you would afford respect, but not too much.

I've met some pretty famous people and I think that that is the attitude that is most appreciated by the other side.

Treat them like you would like to be treated if the situation were reversed.

I know all this is common sense, so probably nothing useful that you didn't come up with yourself.

Your hard work is starting to pay off and that means that you have a right to speak, so do so, don't be shy.

I wouldn't call myself 'more successful', but I've been in that position some time ago and of all the 'famous' (or wealthy, or both) people I've met I'm pretty sure I learned more about doing business than I ever thought possible.

Keep your ears wide open, these opportunities are not going to come by with any frequency.

good luck!

</comment><comment><USER3> Start by learning how to accept congratulations.

And after that you need to learn how to say no to friends and family.

Other than that, just remember that when you get called up to the big leagues, you're still at the bottom of a big pile. Don't forget how to be a scrappy underdog.

</comment><comment><USER4> I think you need to read the Felix Dennis book "How to get rich". He talks a lot about what you are asking about. And its pretty short, so you can read it over a weekend

<comment><AUTHOR> I'm not driven by getting rich, I'm driven by seeing my work come to fruition & having an impact. (I'm _very_ driven by this, though.)

Will his advice apply? Anyway, I'll check it out, thanks.

<comment><USER4> Yeah should apply, although in your situation you can pretty much start reading mid way through. That's where he deals with management level things you should/shouldn't do in order to preserve your success.</comment></comment></comment>


How to Tame Google, Facebook, Amazon and Apple - <AUTHOR> https://www.bloomberg.com/news/features/2017-11-29/how-to-tame-google-facebook-amazon-and-Apple <comment><USER2> 404\. Looks like it was Bloomberg the one who was tamed.

<comment><USER3> A quick magical search on google found me: [https://www.bloomberg.com/news/features/2017-11-29/how-to- ta...](https://www.bloomberg.com/news/features/2017-11-29/how-to-tame-google- facebook-amazon-and-apple)

<comment><USER3> This article is irritating. Let's break apart these powerful and successful companies. We'll put their big moneymaker into its own companies, and let the little pieces die. Google puts search into one company, android into another. everything else would die (cloud say). Let's crush microsoft, put office in one company, consumer in another, os in a 3rd, and let azure die because it would be hard to capitalize otherwise. apple could be 2 companies, phone and computer.

What is needed is a way to incentivize other companies to try these spaces. Without azure, microsoft would be looking doomed - if you split it off, it would be doomed on its own. big companies should be able to reinvent themselves.

I do see the issue of these companies squeezing out smaller competitors.</comment></comment></comment>


Tetris Code Challenge - <AUTHOR> http://tetrisapp.appspot.com/

<comment><USER2> If you want to be super accurate, real tetris lets you move the piece as it's falling, even for a short time while it's touching the ground. But whatever.

This is an awesome idea, though Tetris may not be the greatest choice for AI, since it's really a twitch game. I suspect Hickson's score is already close to the upper limit.

This is my favorite programming competition: <http://www.cs.ualberta.ca/~darse/rsbpc.html>

</comment><comment><USER3> I don't think the scoring system is good. According to it the best behaviour would be to build all tetraminos on one side and wait for "I" tetramino to arrive and score 4.

Maybe instead of that people should try to maintain lowest possible average height of the tetris.

Also, people should be given same sets of inputs. Giving higher percentage of "I" tetraminos to some players (even if this happens by pure luck- randomly) would be unfair advantage.

Also, great idea to post some sample applications in Python and C# (thumbs up!)

<comment><USER4> Keeping the stack low is the easiest task in the game. Tetris scoring is designed to reward the risks involved in building a high stack.

You can't give 100% repeatable inputs as that opens the door to a fixed, hand- optimized placement pattern. If this is an issue, sample 100 runs and take one from the best, worst, and median cases.

What could be improved is to add some amount of "next piece" data. More data = more ability to use planning instead of probabalistic AI.

Initial configurations with garbage filling the bottom are a good way to test AI robustness, so I would recommend adding a mode for that.

Last, the most prestigious test would be to include the two-player modes. Like C-Robots or Corewars, but with Tetris :)

</comment></comment><comment><USER5> Points for clever usage of HTTP for testing clients.</comment>


A closed letter to myself about thievery, heckling, and rape jokes - <AUTHOR> http://www.pattonoswalt.com/index.cfm?page=spew&id=167

<comment><AUTHOR> I submitted this because of the impressive level of introspection Patton Oswalt displays in this letter.

It's a fantastic piece on different perspectives and allowing yourself to change your view, especially on something you care deeply about.

</comment><comment><USER2> Interesting take on comedic "IP".</comment>