A Systematic Analysis of the Juniper Dual EC Incident [pdf] - <AUTHOR> https://www.cs.uic.edu/~s/papers/juniper2016/juniper2016.pdf <comment><USER2> I gotta say, the combine subtlety of this vulnerability is impressive:

\- There is a config flag, which may or may not have a valid use. I'm not a networker or security expert, I cannot tell.

\- That config flag in turn causes two random number generators to interact via a global variable to cause a small off-by-one error. Furthermore, both code pieces don't look strinkingly wrong, from a cursory glance by someone not familiar with the code base. I've seen worse code being approved in a review.

\- This boundary error leaks internal state of the inner EC-based PRNG, which allows an attacker with prior knowledge, sufficient computing capacity and solid knowledge of math and crypto to get the state of the inner RNG

\- This information can be exfiltrated through both a complex queue/pool- system and a complex handshaking protocol. Maybe I'm more familiar with PRNGs, but the IKE part started to go over my head.

I've always acknowledged the idea of very subtle, deniable and complex vulnerability introduction, both through cryptographic conditions, subtle code and language issues and all of that. Software is hard and complex.

But this is an example that's both scary, very complex and close enough to comprehension to be very, very scary without being vague. Thank you for the analysis and the write-up.

<comment><USER3> I have a feeling you already know about it, but for others that really enjoy reading these kinds of exploits, the "underhanded C contest"[0] is fantastic reading material that will give you very similar feelings.

It's terrifying how even simple code can hide extremely bad exploits. Many of the entries even follow every linter/compiler warning/best practice out there.

[0] [http://www.underhanded-c.org/](http://www.underhanded-c.org/)

</comment></comment><comment><USER4> Abstract: [https://eprint.iacr.org/2016/376](https://eprint.iacr.org/2016/376)

In December 2015, Juniper Networks announced that unknown attackers had added unauthorized code to ScreenOS, the operating system for their NetScreen VPN routers. This code created two vulnerabilities: an authentication bypass that enabled remote administrative access, and a second vulnerability that allowed passive decryption of VPN traffic. Reverse engineering of ScreenOS binaries revealed that the first of these vulnerabilities was a conventional back door in the SSH password checker. The second is far more intriguing: a change to the Q parameter used by the Dual EC pseudorandom number generator. It is widely known that Dual EC has the unfortunate property that an attacker with the ability to choose Q can, from a small sample of the generator's output, predict all future outputs. In a 2013 public statement, Juniper noted the use of Dual EC but claimed that ScreenOS included countermeasures that neutralized this form of attack.

In this work, we report the results of a thorough independent analysis of the ScreenOS randomness subsystem, as well as its interaction with the IKE VPN key establishment protocol. Due to apparent flaws in the code, Juniper's countermeasures against a Dual EC attack are never executed. Moreover, by comparing sequential versions of ScreenOS, we identify a cluster of additional changes that were introduced concurrently with the inclusion of Dual EC in a single 2008 release. Taken as a whole, these changes render the ScreenOS system vulnerable to passive exploitation by an attacker who selects Q. We demonstrate this by installing our own parameters, and showing that it is possible to passively decrypt a single IKE handshake and its associated VPN traffic in isolation without observing any other network traffic.

</comment><comment><USER5> Video: [https://www.youtube.com/watch?v=JRneMj7LX8U&list=PLC86T-6ZTP...](https://www.youtube.com/watch?v=JRneMj7LX8U&list=PLC86T-6ZTP5jdbiwi5ggLNnwLn1-r0M4h&t=52m15s)

A summary of what happened back then: [https://cryptologie.net/article/316/junipers- backdoor/](https://cryptologie.net/article/316/junipers-backdoor/)

</comment><comment><USER6> Why anyone would trust Juniper firewalls or VPN's after this incident is the question.

Against the advice of the cryptographer community, they implemented a known backdoored algorithm in 2008, and then let that backdoor be usurped by unknown attackers until discovery in 2015.

Every piece of code released by Juniper should now be questioned for back doors.

</comment><comment><USER7> Can anyone with more knowledge than me comment?

This seems to be "The NSA (?history of elliptic curve hackery) added code to enable them to snoop on VPNs running on Juniper routers and juniper think they fixed it but didn't"

Are the routers now locked down? Will we ever know? How on earth did someone add to their binary?

Is there a bigger picture here?

<comment><USER8> I think the biggest implication is how far they're willing to go to compromise commerical hardware. This could ruin Juniper, a large US company. It's insane that the government allowed them to do this.

The first thing I think of is phone basebands. If they're hacking enterprise firewalls I have to assume they've already exploited the baseband in the vast majority of phones. It's the one place they can stick a software plant over the airwaves.

I think it's time to call for open source basebands, anything else just isn't safe anymore.

<comment><USER9> Open source baseband only won't be enough, there are plenty of CPUs/MCUs capable of running backdoors/malware spread on any modern board (heck, even battery controller often runs on a full fledged MCU). Until we have an open hardware + software, we will never be safe from government and other well- funded crooks.

<comment><USER10> > Open source baseband only won't be enough,

Not sufficient, perhaps, but necessary. A 0-day in baseband firmware seems a helluva lot more attractive a target than in a battery controller MCU.

<comment><USER11> Exactly. Such is the entire point of a firewall.

If you don't have a _remotely_ exploitable vulnerability, it doesn't scale to global panopticon levels.

</comment></comment></comment></comment></comment><comment><USER8> Low effort comment, but I think it's hilarious how much the NSA has started to look like a Bond villain.

Just waiting for the day we find out about their secret lair inside an extinct volcano where they're breeding sharks with lasers attached to their heads.

<comment><USER12> We don't know that it was NSA, and in fact it's a little unlikely that it is, because NSA is the author of Dual_EC and the standard includes recommended default values for Dual_EC's Q, which we can presume NSA knows the dlogs for.

The smoking gun for this backdoor was a modified Q, which NSA wouldn't have to do, and which represents _truly spectacularly bad_ tradecraft, by drawing attention to a backdoor NSA claims isn't a backdoor in a way that leaves virtually no doubt that it's a backdoor.

<comment><USER13> I don't think it was the NSA either, but do note that Juniper itself had originally Q set to a different value than the recommended one, and then _that_ value was modified.

<comment><USER12> Right, the "original" code is also super shady! I like (but don't believe) the story where the later backdoor was actually USG, but done to break some other country's NOBUS backdoor.

</comment></comment></comment></comment><comment><USER14> I wonder what software did the layout for the article. I hope it was not LaTeX. That first blockquote is really bizarre.

<comment><USER15> It was indeed LaTeX. The ACM format creates a 1" box at the bottom of the first column which contains the copyright information. The copyright information on the authors' version (yes, I see the typo in the document now) doesn't take up much space so there's a lot of white space.

The block quote itself is just \begin{quote} ... \end{quote}.

The published version looks like this [https://imgur.com/puBzzdZ](https://imgur.com/puBzzdZ)

<comment><USER16> Hmm, I was going to say it was LaTeX, and that for all it's strengths, it always did strange things with boxes interacting with pagebreaks.

But there's nothing so bad that publisher's addon packages, and standards can't make worse.</comment></comment></comment>


New string search algorithm - <AUTHOR> http://volnitsky.com/project/str_search/ <comment><USER2> Interesting.

Note that the worst case of complexity for this algorithm is much, much worse than the worst case complexity for Boyer Moore. Do not use this algorithm carelessly. For example, if you use it in a thoughtless way in your web server, you may open yourself to a DoS attack.

Note that the author nicely characterizes it as of potential use for small alphabets and possibly multiple substrings (in a single search). That immediately made me think he might have devised it for genomics research. In most applications I would think you'd also want regexp features. Interestingly, DNA research and use in a regexp engine is something he goes on to suggest. (If you are searching for a very large number of regexps in a big genome database, I would not use this algorithm. I found that some simple variants on classic NFA techniques work very well for a wide class of typical regexps (e.g., regexps modeling SNPs, small read position errors, small numbers of read errors, etc. There probably isn't any one obviously right answer, though, and a lot depends on your particular hardware situation, data set sizes, etc.).

The HN headline is very bogus hype. "X2 times faster than Boyer-Moore" is far from true in the general case. "breakthrough" is a gross exaggeration: this is a technique that anyone with some good algorithms course or two under the belt should be able to think of an, for most applications, decide to not use because of the limitations of the thing. I can definitely see it being nice for some applications tolerant of its limitations but... breakthrough it ain't.

<comment><USER3> For sequence alignment, the state of the art is BWA, which first compresses the "haystack", then builds a trie.

See <http://en.wikipedia.org/wiki/Burrows–Wheeler_transform> or [http://bioinformatics.oxfordjournals.org/content/early/2009/...](http://bioinformatics.oxfordjournals.org/content/early/2009/05/18/bioinformatics.btp324.full.pdf)

<comment><USER2> Thanks. That's interesting. I'm pretty confident that you don't really need to compress the reference that way. It doesn't make a lot of intuitive sense that you would, in a way: streaming over the reference can be very fast and the question is how many reads you can align per pass, how flexibly, and with how low a pre-processing cost. I think my stuff (which doesn't count since we didn't get to publication stage for other reasons, etc.) was probably faster and more flexible.

<comment><USER4> You'd be prerty confident in the other direction once you understand the problem better. The BWT is not compression as much as an extremely clever way of rearranging the haystack. There are many many different string alignment (not string search) algorithms that are useful with DNA, and where the BWT is used your algorithm is not going to be in the realm of useful. BWT based aligners run in time completely independent of the haystack length. When you have 2 billion needles of size 50-200, and the haystack is 3 billion long, it makes a ton of sense to pay the preprocessing cost of O(n lg n), since it only has to be done on the order of once a year.

<comment><USER2> Given a (not even very large) cluster, we (with the fairly brute force-ish but cleverly tuned NFA) can populate hash tables for the read-based NFA of your 2 billion needles just about as fast as you can transmit the data and give you optimal alignment (by flexible criteria) just about as fast as you can then stream through the 3 billion base pairs. We are down to, at most, single or double digit dollar differences either way, but mine is vastly simpler and easier to tweak. Probably, we can do my way cheaper as the commodity computing market improves.

If you want to tell me that BWT is more useful for something like searching an FBI or CIA DNA database, and that intel types want to encourage commercial development of BWT (even if irrational for the customers) to subsidize its covert use in intel -- that I can believe. I can see where it would be helpful not for resequencing (a way to read off interesting details of an individuals genotype based on a lot of reads) but rather for fingerprinting of suspects and surveillance targets against a large database of reference genomes.

<comment><USER5> Burroughs-Wheeler transform is not just an academic idea, but is the basis for one of the standard tools for aligning short reads: <http://bowtie- bio.sourceforge.net/index.shtml> . There was a mention of compression earlier in the thread, but this is a red herring: BWT also used in bzip2's compression, but the use with DNA sequences is not to compress, but a pre- processing step on the haystack. As epistasis said, when you have billions needles, it makes sense to pre-process the haystack so that the per-needle cost is as low as possible.

As for the FBI's DNA database, this does not consist of sequence data, but, I believe, just microsatellite data. Even if they had full sequence data, it wouldn't make sense to search for new samples against the whole database, but to align the sample with a reference genome and then match the variations across a database of variations.

<comment><USER2> I get that its the standard but see my comment above. If you can come close to I/O saturating inputing read data at only the cost of streaming the reference near I/O saturation, that's optimal -- and I don't think you need the hair of BWT to do that (and the BWT memory cost might even hurt you).

Its different for an imagined database where you are trying to align reads against a lot of personal genomes, e.g., to identify someone given a pretty complete genomic database of the usual suspects plus a few reads from the crime scene -- more around-the-corner "GATTACA" scenario than today's FBI, perhaps. There, perhaps, its economic to dedicate one server to ever N "usual suspects", loading the server with BWT of the suspect database, then stream reads out to the servers rather than loading servers with set of reads and streaming a single-human reference over that. (Of course, maybe you could just align the crime scene reads against a single human reference and then .... So even in GATTACA land use of BWT seems like dubious hair against a lightweight opponent like MAQ)

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> No DBLP profile for the author, no proofs on site, fastest algorithm known "to _me_ " qualifier, no results for "suffix tree" on page, not a good sign.

EDIT: Am I missing something???

Complexity analysis according to the author: m = search term, n = text

O(m) preprocessing -- that's right, O(search term). And O(n times m) worst- case query string search, so the worst case traverses the whole text.

Now compare that to suffix trees:

O(n) preprocessing O(m) string search

where worst case complexity is linear in _search term_.

<comment><USER7> He's a Russian hacker. That's where awesome new algorithms come from these days, including things like Dual-Pivot Quicksort. (And QuickLZ may have been invented by some Scandinavian guy, but I'm pretty sure it was announced on encode.ru.) He's not an academic, but that doesn't mean he can't do competent algorithmic analysis.

I concur with the other commenters that it's silly for you to complain about his not comparing his online string-search algorithm against offline string- search algorithms that search an index of the text, such as suffix-tree algorithms.

<comment><USER8> Dual-Pivot Quicksort is an "awesome new algorithm"? Hardly. It's very small step in the direction of Samplesort -- which is asymptotically optimal and has been around for four decades.

Dual-Pivot Quicksort is a demonstration that someone didn't read the existing literature; nothing more.

<comment><USER7> Unfortunately I don't have access to the Samplesort paper, so I don't know which sense of "asymptotically optimal" you're using here. Quicksort is already asymptotically optimal in the sense that its asymptotic average performance is Θ(N log N), which is the best a sorting algorithm can do.

It's true that dual-pivot quicksort is a step in the direction of Samplesort. (I _do_ understand Samplesort well enough to say that.) That doesn't mean it's not a worthwhile contribution in its own right. Jon Bentley (advisor of Brian Reid, Ousterhout, Josh Bloch, and Gosling while at CMU; later at Bell Labs in its glory days) was quoted as having a substantially different opinion from yours:

[http://permalink.gmane.org/gmane.comp.java.openjdk.core- libs...](http://permalink.gmane.org/gmane.comp.java.openjdk.core- libs.devel/2628)

> I think that Vladimir's contributions to Quicksort go way beyond

> anything that I've ever done, and rank up there with Hoare's original

> design and Sedgewick's analysis. I feel so privileged to play a very,

> very minor role in helping Vladimir with the most excellent work!

I am not sure Bentley will be persuaded by your claim that he didn't read the existing literature.

<comment><USER9> When that thread came up originally, I was intrigued by the idea of the dual- pivot quicksort, and went on to browse Robert Sedgewick's Ph.D. thesis, _Quicksort_, published in 1978. Sedgewick considers and analyzes several variants of quicksort in his thesis, and I've quickly discovered that he analyzes and dismisses the dual-pivot variant under a different name. I don't know whose analysis is better, but it does follow that we shouldn't treat dual-pivot qsort as an original invention (not to detract from Vladimir Yaroslavskiy's doubtless ingenuity).

Here's an excerpt from the email I wrote to Prof. Sedgewick back then; he didn't reply, so I've no idea what he thinks about this:

"I believe that your PhD thesis studies this under the name of "double partition modification". I could find no real difference between the two algorithms. Yaroslavsky claims to achieve a factor of 0.8 improvements over the standard quicksort on the number of exchanges (neutral on comparisons), while your analysis led you to reject the technique after concluding it required many more comparisons than the standard quicksort. I've only attempted very cursorily to reconcile the math; it seems that both your thesis and Yaroslavsky arrive at 0.8n(log n) as the average number of swaps, but you have (1/3) n(log n) as the average number of swaps in the classic algorithm while Yaroslavsky has 1.0 n(log n) for the same thing, so what he sees as an improvement you viewed as a disaster. My interpretation of this may be wrong, and I haven't attempted to verify either analysis yet."

The "classic algorithm" in the above is the classic quicksort as presented by Sedgewick in the thesis, which is slightly different than e.g. the standard Java implementation. I lost interest soon thereafter and stopped investigating this, but it shouldn't be too difficult to find out who was right in that algorithm comparison, if someone's interested enough.

<comment><USER8> Times change. The relative cost of a compare is considerably higher now than it was in 1978, thanks to the cost of branch (mis)predictions.

It's entirely possible that a modification which was a significant loss in 1978 is a significant gain in 2008.

<comment><USER7> Yes, but the number of comparisons and the number of swaps wouldn't change. Sedgewick and Yaroslavskiy can't both be right, unless anatoly misread something.

<comment><USER8> Oops, I misread what he wrote.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Pattern matching performance also depends on the alphabet size of the text. In his experiment he doesn't report the alphabet size of the text nor does he provide results for different text collections.

The algorithm itself looks very similar to the one used in agrep proposed by Wu and Manber [1].

I also found the book "Flexible Pattern Matching in Strings" to be a very good reference on all things related to pattern matching [2].

[1] S. Wu and U. Manber. A fast algorithm for multi-pattern searching. Report TR-94-17, Department of Computer Science, University of Arizona, 1994.

[2] [http://www.amazon.com/Flexible-Pattern-Matching-Strings- Line...](http://www.amazon.com/Flexible-Pattern-Matching-Strings- Line/dp/0521039932)

<comment><USER2> He talks a bit about how to pick the right number of successive letters to use as hash keys - which is where you can get a handle on alphabet sizes. I would guess (maybe it actually says) that he Wikipedia dump in the benchmark was UTF-8 or ASCII and, either way, treated as an alphabet of 8-bit characters. The DNA case is kind of interesting (2 bits min but more likely 3 or 4 in a typical genome record).

<comment><USER10> An illustration from the book I cited above showing the importance of the alphabet size (y-axis) and the pattern length (x-axis):

<http://i.imgur.com/KGOZW.jpg>

In the experiment he used patterns of different length on the same text collection. As you can see in the graph, different algorithms perform best for a certain alphabet size.

He describes the text collection as "text corpus taken from wikipedia text dump" so I'm guessing the alphabet size is around 90?

It's also probably not a good thing that all the strings he is searching for are prefixes of the same pattern.

References:

Shift-Or: [http://www-igm.univ- mlv.fr/~lecroq/string/node6.html#SECTION...](http://www-igm.univ- mlv.fr/~lecroq/string/node6.html#SECTION0060)

BNDM: [http://www-igm.univ- mlv.fr/~lecroq/string/bndm.html#SECTION0...](http://www-igm.univ- mlv.fr/~lecroq/string/bndm.html#SECTION00300)

BOM: [http://www-igm.univ- mlv.fr/~lecroq/string/bom.html#SECTION00...](http://www-igm.univ- mlv.fr/~lecroq/string/bom.html#SECTION00245)

</comment></comment></comment><comment><USER11> The author states that preprocessing takes O(m) time but that is on average.

A quick review of the code makes me think that its worst case is actually on the order of O((s * (s + 1)) / 2), where s = m / 2.

The Achilles heel is the hash function. It's trivial to create collisions and have the insertion time for word w turn from O(1) to O(w).

<comment><USER12> Um, O((s * (s + 1)) / 2) = O(m^2). Quadratic, not exponential.

<comment><USER11> Sorry, I updated my comment just as you posted yours.

But - and I don't want to sound pedantic - how is m^2 not exponential growth?

Edit: mea culpa guys, I carelessly translated from Dutch. You're all right: quadratic, not exponential growth.

<comment><USER13> Because 2^m and m^2 are very different...

Using terminology like "exponential" and "quadratic" correctly in a discussion of algorithms is not pedantic...

</comment></comment></comment></comment><comment><USER14> If i am gonna need a string search algorithm for something serious, i would definitely use KMP (knuth morris pratt). Linear in worst case complexity (wouldn't risk)

</comment><comment><USER15> This seems like a very practical website about the algorithm but where is the theory and proofs of the time complexity of the algorithm??

<comment><USER2> I don't mean to be a turd but the proofs are kind of obvious on the face on this one. He's claiming expected linear time in the string being searched for "natural" texts and worst case O(M _N). Proof of the worst case is pretty trivial by construction (of examples of that complexity) and contradiction (reaching the non-existence of worse cases). One can't be casual about proofs of course but: try thinking of an O(M_ N) example and then you can probably see from there why you can't do worse than that. Hint: if you can construct an example where you have to do the length M check for nearly every position in the length N haystack, aaaaaaaah... hmmmmm...., the rest should be clear.

</comment></comment><comment><USER16> From the site:

>Preprocessing phase in O(M) space and time complexity. Searching phase average O(N) time complexity and O(N*M) worst case complexity.

I don't trust the analysis of someone referring to "average O(N) time"; Big O notation refers to boundary times.

Edit: Okay, based on arguments here and on [1], I'm going to accept that maybe he's just bastardizing the notation.

[1] [http://stackoverflow.com/questions/3905355/meaning-of- averag...](http://stackoverflow.com/questions/3905355/meaning-of-average- complexity-when-using-big-o-notation)

<comment><USER6> > Big O notation refers to boundary times.

No it doesn't. You can have an O(N) amortized time. Big-O is a bounding function up to a constant factor, not necessarily a boundary (as in worst- case) time.

<http://en.wikipedia.org/wiki/Amortized_analysis>

<comment><USER17> To say that something runs in amortized O(n) time guarantees an upper bound on the average time per operation in a worst-case sequence of operations. It does _not_ deal with average-case time on random or typical data.

<comment><USER6> I didn't say it did. On the other hand, unless the author of the algorithm is really clueless (edit: or knowingly making a probabilistic statement), I'm sure he meant amortized time.

</comment></comment></comment></comment><comment><USER18> Skeptical but excited. Will definitely be studying this at the weekend. I had been working on a long writeup on string matching but stopped the project for lack of recent progress.

</comment><comment><USER19> it seems that his algorithm is faster because it exploits the model of computation (memory aligned accesses and multi-byte operations). He gets up to a constant factor more comparisons for free.</comment>


How To Choose the Right Incubator For Your Startup (notes) - <AUTHOR> http://mindovermeta.com/2011/06/how-to-choose-the-right-incubator-for-your-startup-notes/

<comment><AUTHOR> Good notes on what each of these panel members had to say:

        Jonathan Abrams, Entrepreneur, Founders Den
        Dave McClure, Founding Partner, 500 Startups
        Adeo Ressi, Founding Member, TheFunded.com & Founder Institute
        Kindra Tatarsky, VP Silicon Valley, Astia
        Cameron Teitelman, Founder & Managing Director of StartX</comment>


Show HN: A simple CRM for commercial real estate - <AUTHOR> https://targets.towerhunt.com/ <comment><AUTHOR> Hi, I'm Matt. I built this tool last week and wanted to get feedback on it right away.

Direct investment in commercial real estate is difficult. Finding good deals is a big part of the job. Among other things, this takes industry contacts. These contacts are good at certain things. Take brokers for example. Some know office buildings. Others only sell apartments. Each has a geographic focus.

Brokerage is difficult for a similar reason. You need contacts who own buildings. You also need contacts who buy buildings. (Both are investors.) By definition, brokers need to match these groups. But each investor is good at certain things.

Because of this, it's important to be able to reach the right people for each deal. This requires organization and context, which take effort. Successful investors and brokers don't have much free time or patience. So, this product tries to optimize context vs effort. More context than your phone's contacts app. Less effort than a full CRM. It does this by using investment criteria ("targets") to connect people. Then it maintains a contact list based on those connections. You can share targets via link.

I'd be grateful for any feedback, even if you aren't familiar with commercial real estate. Thank you!</comment>


Database management for public and private clouds - <AUTHOR> http://www.building43.com/videos/2012/11/28/scalegrid-database-management-for-public-and-private-cloud/

<comment><USER2> I can say as a beta tester, this product has huge potential! Can't wait for more. Great to see Scoble covering this.

<comment><AUTHOR> Thanks!

</comment></comment><comment><USER3> We are definitely thinking about postgres support. Our current supported databases are MongoDB, MySQL and MS SQL.

</comment><comment><USER4> At last end to end database management. Can we get postgres support? At last I can focus on my app now.

</comment><comment><USER3> We support private clouds like OpenStack, CloudStack and VMWare and public clouds like EC2, Rackspace.

</comment><comment><USER5> This is pretty cool. Excited to try it out! Does this work on VMWare?

<comment><AUTHOR> Yes we do support VMware. More info at <http://www.scalegrid.net></comment></comment>


Questions the FBI Uses to Determine If Someone Is a Likely Terrorist - <AUTHOR> https://theintercept.com/2017/02/13/48-questions-the-fbi-uses-to-determine-if-someone-is-a-likely-terrorist/ <comment><USER2> The questionnaire seems pretty fair, to be honest.

If someone has access to weapons, tried to travel to a terrorist training camp, has mental instability issues, supports use of violence as well as using religion as a justification for violence and follows all the ISIS social media accounts, I'd be pretty worried.

I didn't see any questions about "does the individual holds a significant distrust of government and institutions?" or "does the individual own multiple anarchism books?". All the questions are very specific and practical.

<comment><USER3> The guy (girl?) you describe in the second sentence is very obvious to identify. The problem is not there.

I am in Quebec City. A terrorist killed 6 people here a few weeks ago. A young, quiet, white catholic guy with clean looks. He killed 6 muslims during their prayers.

Would that questionnaire have identified that young, quiet, white catholic terrorist killer?

<comment><USER4> > Would that questionnaire have identified that young, quiet, white catholic > terrorist killer?

Possibly, but it's difficult to say based on your description, because age, skin color, general quietness, and religion are not on the questionnaire.

But to your broader point, could a questionnaire be written well enough to reliably identify all terrorists? If it only significantly improves detection, I'd think it would be worthwhile.

<comment><USER5> The problem with that reasoning is that if you rely on a detection method that's biased towards a specific target a competent terrorist organization can profile that method and then have a better than average change of passing through by behaving in an opposite way. That's why profiling doesn't work all that well against any sort of sophisticated enemy.

</comment></comment></comment></comment><comment><USER6> Honest question: is this the type of material that should be leaked? Is there an overriding good to revealing this document to the public?

I lean towards no, but I'd be interested in discussion on this.

<comment><USER7> I am a convert to Islam and I say yes, I'm ready for the gap between reality and "common sense" to close on this topic.

I don't consider it offensive to talk about these issues openly because I am secure in my knowledge that Islam does not encourage terrorism. I'm more offended when people sweep it under the rug. When it's about safety, people have to leave their fears and biases at the door and accept the truth.

A typical person in some parts of America today will look at a practicing Muslim and automatically see a terrorist, but that's neither helpful nor accurate. The facts don't support that stereotype, and I think the FBI understands that. Of course ideology plays a role in detecting threats, but there are other factors that may play a bigger role, like mental health, social stability, criminal history, training in weapons, etc. If everyone understood this, it would lead to more accurate tips by the public to law enforcement, and the concept of a "Muslim ban" wouldn't be seen as productive. But the centuries-old narrative of Muslim hordes attacking the West has been revived, and that is how people see the issue, and that's unfortunate.

<comment><USER8> >but there are other factors that may play a bigger role, like mental health, social stability, criminal history, training in weapons, etc

Sounds like we need some sort of way to vet people coming into the country?

<comment><USER9> At least on my fb feed, it's a far-right trope that refugees are admitted with no vetting process whatsoever. Enough that I managed to research it and found this very informative infoposter from the Obama administration:

[https://obamawhitehouse.archives.gov/blog/2015/11/20/infogra...](https://obamawhitehouse.archives.gov/blog/2015/11/20/infographic- screening-process-refugee-entry-united-states)

note: multiple stages of bio checking, numerous three-letter agencies, additional steps for Syrians.

I used to post this every other day on fb, but lately I just realize there are simply groups who repeatedly gaslight each other and aren't interested in reality. One of them referred to my post as "liberal facts," implying, apparently, that the government doesn't perform the above screening process which it claims it does. shrug.jpg

<comment><USER10> My argument isn't that the USA performs no screening, which is a strawman argument. It's that the screening process is inadequate. That is a nice checklist, but it relies on unreliable data such as documents and iris scans.

Unless the government has every present and future terrorist's fingerprints in a database, how will scanning fingerprints be effective? It cannot be, it logically does not make sense. This logic is confirmed by FBI director Comey who told congress the same thing.

Perhaps that is where your disagreements with the "far-right" are stemming from?

<comment><USER11> Why do you think it's inadequate, and what would be adequate?

</comment></comment></comment></comment></comment></comment><comment><USER12> Access to weapons: most of America, or all of America depending upon whether shopping is considered access and how 'weapons' are defined.

Has 'trained' overseas: anyone with a passport.

Has 'tried to acquire' bomb-making materials: Reading a book is not illegal. Clicked on the wrong torrent?

Using encryption: everyone.

Masking internet browsing: everyone.

Showing an interest in terrorist events: everyone.

"participating in activities that simulate military or operational environments": anyone who has ever been camping/hiking/played an FPS.

Changed appearance or habits? everyone.

Has "experienced a recent personal loss or humiliation"? Many people.

Has a history of mental health problems? A large proportion of the population.

Substance abuse. Almost everyone.

Hold a belief or ideology that supports the use of violence? Oh what, like "are they a current or former member of the military, politics, or big business?"

This is all really disconcerting in its vagary and scope for misapplication.

<comment><USER13> I really think you overshoot here on almost every point. The ones that stick out for me: * Not everyone has trained overseas. In the west/east bubble maybe that's common, but nowhere else.

* You seriously try defending reading bomb-making books? To imply that reading a book on how to make bombs, without any background need for it like a job related to pyro, etc., is not suspicios is IMHO rediculous.

* Not "everyone" uses encryption. Actually, the majority of web users do not, and less so knowingly.

* Not "everyone" will suddenly and completly change the overall theme of themselves.

* Not "everyone" has recent loss or has been humiliated.

In general, your other points are getting onto something and i somewhat agree.

However, to be honest I don't think a break down approach is the best to gain incite into the FBI's process. The questions are supposed to be treated as a whole, not singulars. Each question is not designed to give a yes/no answer; but rather the end result, suspicion of terrorism, is a complex, non-analytic function of all the answers

<comment><USER12> _You seriously try defending reading bomb-making books?_ Yes, because freedom to seek and impart information is a human right. More practically, if you start down this path of forbidden knowledge then you wind up at a point where learning or teaching at all is a banned, inherently political act. What about reading about physics or chemistry on Wikipedia? An interest in metalwork, sculpture, jewellery or pottery? Being observed working on "unknown" metal projects at a makerspace, keeping to yourself, and paying in cash? People deserve to be judged for their actions alone and not obtuse, politicized potential interpretations of their interests or past behavior generated by the secret machinations of the state, perversely nominally on their behalf and in the name of 'freedom'.

 _the majority of web users do not [use encryption]_. False.

</comment></comment></comment><comment><USER14> Material for the new Buzzfeed quiz "Are You Likely a Terrorist? Answer These 48 Questions to Find Out!"

</comment><comment><USER15> Question 48: "Does the Subject take an unusual interest in Terrorist identification quizzes?"

</comment><comment><USER16> I'm curious how it's ok for a US company (The Intercept) to publish a Secret document?

The documentcloud.org file clearly shows: _Contributed by: SooHee Cho, The Intercept_.

And the documentcloud.org server itself appears to be located in the US as well.

Seems like something you could go to jail over.

<comment><USER17> Unlike in e.g. the UK, where the Official Secrets Act applies to the population at large, the prohibition against leaking or unauthorized possession of classified information is exclusively applicable to people with clearances.

Think of a Security Clearance as a scoped waiver of free speech in return for access to sensitive information. In the US, you have to opt-in to restrictions on your freedom of speech. Anyone without a clearance is protected by the 1st amendment, which has no National Security exception.

<comment><USER16> I see - thank you!

</comment></comment></comment><comment><USER18> Assuming the list was derived scientifically, then this seems like a pretty sensible and useful law enforcement tool. It can be easily filled in by front line officers and gives them a good idea which lines of investigation to pursue.

</comment><comment><USER19> 1\. Did the suspect download the document "Imv-Score-Final"?

</comment><comment><USER20> > "Does the Subject hold a belief or ideology that supports the use of > violence?"

To the best of my knowledge, the answer to this is yes for every US president and Founding Father.

Or to put it another way, what a dumb question.

</comment><comment><USER21> Are we into precrime now? A criminal is one who is proven in court to be a criminal. Civilized societies use courts to decide the truth, not questionnaires filled out by shady people.

<comment><USER22> But they are not deciding about someone's guilt or innocence here, just whether or not investigate them further.

<comment><USER23> ...before a crime has happened.

<comment><USER24> While on vacation maybe 15 years ago, I went to a library to get internet access. When I went to Google, the search dropdown box showed me that the previous several searches were all about burglary tools. Should the police be interested in that? (They were. And I don't blame them.)

</comment></comment></comment></comment><comment><USER25> Do you not understand the lesson being taught by such an exercise? It sounds like instead your biases made you think the school civics class would be teaching students _how to profile people as terrorists_.

You really are an idiot.

<comment><USER26> We ban accounts that post uncivilly, so please don't do this on HN again. Instead, please (re-)read the site guidelines and post civilly and substantively, or not at all.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

[https://news.ycombinator.com/newswelcome.html](https://news.ycombinator.com/newswelcome.html)

We detached this comment from [https://news.ycombinator.com/item?id=13639873](https://news.ycombinator.com/item?id=13639873) and marked it off-topic.

<comment><USER25> fuck you dang ban me

</comment></comment></comment><comment><USER27> So is HN considered a terrorist site since it requires a password to submit stories and post comments?

<comment><USER28> Neither of those things are mentioned in the document.

<comment><USER27> Question 21) "Has the subject engaged in [...] tradecraft to hide their online activities contextually different from previous activity? [...] password- protected websites."

I don't think it's unreasonable to ask whether password-protected websites are only an issue if they are being used to hide online activities. Or is this a strict liability thing, where any use of a password protected website is taken to mean that a user is attempting to hide their online activities.

<comment><USER17> That's impressive gerrymandering of the text to reach that conclusion. Try and zoom out a little bit (I know, terribly mixed metaphors).</comment></comment></comment></comment>


Hello, President Rousseff...I told you so. - <AUTHOR> http://www.linuxpromagazine.com/Online/Blogs/Paw-Prints-Writings-of-the-maddog/Hello-President-Rousseff-I-told-you-so

<comment><USER2> The leftist tone of this article gave me allergy. As a Venezuelan that emigrated to another country to escape from the disaster that the so called socialism (which is more like a pseudo-comunism) was installing on the country, I cannot be balanced with the words of the author when he uses Chavez and embargo in the same statement. All I saw in 12 years was a horrible government that had in USA the perfect excuse to cover his negligence.

I understand your feelings fellows US citizens, but please don't over-correct your bad government with another 10 times worse. That's what we did and we regret that every day.

<comment><USER3> Maybe it's just me, but I find it very difficult to understand how your comment relates to the article.

maddog mentioned Chavez and the cuban embargo in order to illustrate a point, which is completely valid: Brazil and any other sovereign nation (excluding the USA... maybe) should be wary about using closed source software and computers made in a foreign country. You can never completely trust them; but there exist alternatives which you can implement right now.

Sorry if you had bad experiences in Venezuela, but you don't need to freak out and start a commie witch-hunt any time Chavez is mentioned. And I live Argentina, so I also have experience with enduring populist governments; but this article isn't about them, at all.

</comment></comment><comment><USER4> FYI

FOSS stands for "Free and Open Source Software"

([http://en.wikipedia.org/wiki/Free_and_open- source_software](http://en.wikipedia.org/wiki/Free_and_open-source_software))

</comment><comment><USER5> Is the only alternative to using software that the NSA may have infiltrated to use FOSS? Seems like there has to be other options. Can anyone suggest any?

<comment><USER6> I would think open-source, minus the "free software" bit, is good enough.

Freedoms 0 and 1, i.e. "freedom to run the program for any purpose" and "freedom to study how the program works, and change it to make it do what you wish" are reasonable. Given how software is taking on more and more critical functions, the days of closed-source software may one day seem quaint.

Freedoms 2 and 3, i.e. "freedom to redistribute copies so you can help your neighbor" and "freedom to improve the program, and release your improvements (and modified versions in general) to the public, so that the whole community benefits" appear more problematic.

[http://en.wikipedia.org/wiki/Free_software#Definition](http://en.wikipedia.org/wiki/Free_software#Definition)

<comment><USER7> Freedoms 2 and 3 seem to be necessary for when you find errors in the software (in particular, bugs that cause security vulnerabilities).

</comment></comment></comment><comment><USER8> \- "I hate to say i told you so Roussef.. now lets talk about that little project of mine.. remember you turn it down because you thought the support and training was too expensive.. it told you so! now here is the contract.. blablabla... "

Good points anyway, in the middle of the salesman speech..

But if he want to get this sort of contract he will need to wait for a bidding offer to show up, and put his project to compete with the others.. and i will say: it will be very difficult that he win something like that.. they require a lot of stuff and certifications from companies; ISOXXX, a certain number of paid people working, certain certifications from the people and the company.. its a hell..

I told you so..

<comment><USER9> Actually he has been in Brazil many times, and I personally saw Jon and Dilma on the same room, although they don't talked to each other. Also Maddog gave speeches witnessed by close advisors.of Dilma, and witnessed by Brazil Government RD company, in fact the government itself frequently.invites Maddog here. So what you are saying is very insulting, Maddog has been trying to convince our government to adopt FOSS even if it ignores Cauã since 2008

EDIT: above post before its own editing was only the part inside quotes.</comment></comment>


My Life at 47 Is Back to What It Was Like at 27 - <AUTHOR> https://medium.com/s/meghan-daum/my-life-at-47-is-back-to-what-it-was-like-at-27-eb7a071b3598 <comment><USER2> One of the things about getting older and divorced, people use to join organizations at higher rates, now we moved to online communities and an online/mobile life.

With a fulltime job and you working till death, you don't have time to do much. The local eagles/lions/moose/etc club, you at least got to go out and have dinner, chat with people, make friends, etc.

I checked out the local Masons lodge, and I was at least 20 years younger so I didn't ask to be sponsored. My friend in Ireland joined the Masons, he says the lodges are filled with younger people from 20s and up.

I read the "Starting over" and think, did you change your hobbies and activities too? There's so much to do now, how can one be bored. Even a trip to the library and parks is cheap and free.

<comment><AUTHOR> I am a member of a fraternal order similar to the Masons ( [https://odd- fellows.org/](https://odd-fellows.org/) ). It's great because:

* There are standing meeting nights that I can go to for social contact

* It does good work in the community

* It lets you meet folks outside of work circles

* It lets you have an opportunity to build soft and leadership skills

* If I have to leave for a while because of work or other time commitments, I know I can rejoin in 1, 5 or 10 years and be welcomed back.

Highly recommend. Even easier if you can get a group of folks to join. And most of the older members I chatted with were thrilled to have new members.

<comment><USER3> I'm seriously considering something like odd fellows (thanks for reminding me of them) - exactly for the non-work social and community aspects - but with a secular flavor ( I have some family members who are in the Lions club). A buddy of mine mentioned "mastermind" groups too.

(ps. fwiw - portland or)

<comment><AUTHOR> Odd Fellows may not meet your needs, but optimists or rotary are a good option.

</comment></comment></comment></comment><comment><USER4> | In 20 years, my life has come full circle, 360 degrees for real. People often say 360 degrees when they mean 180. They say full circle when they're really talking about a semicircle.

I've never experience this, is it common for some group of people to use 180 to mean "the same" vs "completely different"?

<comment><USER5> That caught my eye too. Maybe it's a west coast thing.

In the midwest, to do a 180 is to go in a completely different direction, and to come full-circle is to return to where you were after some long journey.

<comment><USER6> No, I think she just poorly wrote it. "Coming full circle" always means to return to where you started. But sometimes people say "turned it around 360 degrees" when they really mean 180.

<comment><USER7> Yep, Americans don't understand basic geometry any more.

</comment></comment></comment></comment><comment><USER8> I think there's more to life than settling into a fixed set point. Life is interactive: you can improve your experience by putting in the right kind of effort and getting lucky. For example, the author wrote this article and made a strong connection with a bunch of strangers on the internet. Even if the author doesn't feel that way, I do, and that's enough for me. Agency is a muscle, exercise it!

</comment><comment><USER9> This article is so very sad. The author seems to be in a constant state of Deja vu.

<comment><USER10> It depends on how old you are. Life is funny and never turns our how you thought it would. I do like going back and reading the article "Advice, like youth, probably just wasted on the young" by Mary Schmich (popularized by Baz Luhrmann in the song 'Everybody's Free') from time to time[1]

[1] (snippet)

> Enjoy the power and beauty of your youth oh nevermind; you will not > understand the power and beauty of your youth until they have faded

> But trust me, in 20 years you'll look back at photos of yourself and recall > in a way you can't grasp now how much possibility lay before you and how > fabulous you really looked… You are not as fat as you imagine Don't worry > about the future; or worry, but know that worrying is as effective as trying > to solve an algebra equation by chewing bubblegum

> The real troubles in your life are apt to be things that never crossed your > worried mind, the kind that blindside you at 4pm on some idle Tuesday

<comment><USER11> I'm 47, a father of two, happily married to high school sweetheart, about to send first kid off to college. I also found the article very sad: not even a pet to cuddle. :-(

But, the piece is well written and I don't think the author is sad, nor asking for sympathy.

So I'm conflicted in how I feel about it. The author also seems conflicted about whether she wants a man in her life.

<comment><USER12> Their life seems to be a journey and direction different from the norm, yet they seem to be fairly ok with it.

It also seems like they'd be pretty unhappy if they'd had a life like yours (father of two ...), more because it's not suitable for them rather than there anything being wrong with it.

Overall, seems like an interesting - and potentially useful reminder that "it takes all kinds to make the world go around". ;)

</comment></comment></comment></comment><comment><USER13> Can't read, because medium.com says: "You read a lot. We like that. You've reached the end of your free member preview for this month. Upgrade for unlimited access."

<comment><USER14> Click the X in the corner of the popup and continue reading.

<comment><USER15> I'm getting a popup with no X.

</comment></comment></comment><comment><USER16> Well that's 7 minutes of my life I won't get back.

<comment><USER17> I, on the other hand, found the article extremely interesting and well written, even so much so that I saved it to my meager list of articles I may want to reread later.</comment></comment>


Seven Guidelines for Writing Worthy Works of Non-Fiction - <AUTHOR> http://econlog.econlib.org/archives/2009/10/worthy_books.html

<comment><AUTHOR> Bryan Caplan is the author of

      The Myth of the Rational Voter (2007)
      Selfish Reasons to Have More Kids (2011)

both of which are worth reading.</comment>


Simple Is Complex - <AUTHOR> https://avdi.codes/simple-is-complex/ <comment><USER2> I like Rich Hickey's definitions

Simple (roots: sim, plex) – one fold or braid

Complex – braided or folded together

Easy – near to our capabilities

These are really articulate definitions that helped me as a programmer.

Emergent complexity from simple systems – it seems like there might be an insight here. Avdi says we can build complex systems out of simple components. He says complex systems are hard to understand. He says it's not feasible to understand the system or predict it. So they need to be measured and observed. That's interesting. I don't know if it's true that a system built out of simple components cannot be understood. How precise is the model? How many layers deep?

<comment><USER3> Complexity as defined in most scientific disciplines today refers to systems which are "greater than the sum of their parts," i.e., where the behavior of the whole system cannot be predicted by looking at each component in isolation, but only can be understood by the action and interaction between components and how that evolves over time. Most systems of interest are too big to enumerate all the possible n-ary interactions between constituent parts, so we must study them by other means: probe plausible simulations, define and compute statistics from observable data, or fit models which capture plausible correlations. To complicate this further, it usually takes just one cycle or feedback loop in the network / system to introduce enough complexity that most traditional analytical mathematical tools break down.

I studied complex (adaptive) systems as my Master's education and can confirm most techniques reduce to "linearize around the important bits and extrapolate from there".

Examples of complex systems include: social networks (IRL and online), economies, biological systems. Machine learning is one of the most promising tools for probing these because if we can fit an appropriate model, we can hopefully capture enough of the behavior that we can reliably extrapolate to unseen data / states.

</comment></comment><comment><USER4> It feels like the article ended just as it was getting warmed up towards something interesting! If any HN'ers have pointers/links to other interesting analyses of emergent complexity among simple interacting agents, I'd love to read 'em!

<comment><USER5> [https://www.santafe.edu/](https://www.santafe.edu/)

[https://en.wikipedia.org/wiki/Santa_Fe_Institute](https://en.wikipedia.org/wiki/Santa_Fe_Institute)

> The Santa Fe Institute was founded in 1984 ...

> SFI's original mission was to disseminate the notion of a new > interdisciplinary research area called complexity theory or simply complex > systems.

<comment><USER4> Unfortunately a pointer to the Santa Fe institute is a little too broad to my question (which was specifically about interacting agents, and I was implicitly thinking more about physical embodied beings, somewhat in the spirit of Rodney Brooks' robots). Also, I'm keen on concrete analyses rather than vague hand-wavy pontificating.

That said, the Santa Fe Institute is a great resource to be reminded of every once in a while. I'm particularly a fan of a line of research being pursued by Simon Dedeo (and others). eg: _Optimal high-level descriptions of dynamical systems_ [https://arxiv.org/abs/1409.7403](https://arxiv.org/abs/1409.7403)

<comment><USER5> Sorry. I don't have any good references off the top of my head for that.

You know about "BEAM" robotics? [https://en.wikipedia.org/wiki/BEAM_robotics](https://en.wikipedia.org/wiki/BEAM_robotics)

W. Grey Walter's cybernetics "turtles"? [https://en.wikipedia.org/wiki/William_Grey_Walter#Robots](https://en.wikipedia.org/wiki/William_Grey_Walter#Robots) [https://en.wikipedia.org/wiki/Turtle_(robot)](https://en.wikipedia.org/wiki/Turtle_\(robot\))

<comment><USER4> Thanks, I'll check those out! :-)

</comment></comment></comment></comment></comment><comment><USER2> [https://web.archive.org/web/20190929151534/https://avdi.code...](https://web.archive.org/web/20190929151534/https://avdi.codes/simple- is-complex/)

</comment><comment><USER6> Oliver de Weck from MIT has done a lot of work around complexity, including deriving definitions and measures. Turns out there is an objective measure as to how many microservices is optimal. The number comes to around 2.8 connections per component if I remember correctly. Can share the math, if anybody's interested.

<comment><USER7> > Can share the math, if anybody's interested.

Please do!

</comment></comment><comment><USER8> Couldn't really take much from this article, other than I should read that book, it sounds so interesting

</comment><comment><USER9> TL;DR simple mechanisms can produce complex behaviours

My favourite example is the few simple rules of Go leading to possible extreme superhuman strategies.

</comment><comment><USER10> What was the point again?

Simple isn't Complex any more than Love is War or Dark is Light.

System-wide interactions between any kind of components is about as difficult as it gets.

<comment><USER11> Second that. This conclusion "Simplicity leads to complexity." is just too much of a shortcut of the author's own train of thought. As you said, this sentence should read "Interaction and coupling leads to complex emergent behavior". I feel this summarizes this article better.

<comment><USER12> There's a Alan Kay talk[0] that might illuminate for you that leap of logic about simplicity.

[0] [https://youtu.be/NdSD07U5uBs](https://youtu.be/NdSD07U5uBs)

</comment></comment></comment><comment><USER13> tldr; Micro-services architecture can start out simple at first, but when there are many of them, it will become complex even more so than the monolithic approach.

<comment><USER14> Don't put words in the author's mouth; nowhere do they contrast microservices with monoliths.

Also, one of Avdi's main points is that a proper microservice architecture is complex, but NOT complicated. And in my personal experiece, monoliths have a tendency to be complicated.</comment></comment>


Dropbox (YC 07) Thumbdrives - <AUTHOR> http://lifehacker.com/5181049/dropboxportable-syncs-files-to-your-thumb-drive

<comment><USER2> Huh? Why not just use web access?

Isn't a thumbdrive something dropbox hoped to get rit of?

<comment><USER3> If you often use multiple computers for accessing various password-protected things (maybe as a system admin or just the occasional need of accessing something on another computer), then you could use a password manager that runs off of the flash drive and Dropbox portable to keep it synced with new passwords and password changes.

I have Keepass and Dropbox on my flash drive just in case I ever need to access something when using someone else's computer, without having to worry about keeping my password database up to date. Much easier than downloading Keepass on a computer that isn't mine--rude at best, not possible due to permissions at worst--and then downloading the database from the web access and cleaning up when I'm done.

It's helped me once or twice; not often, but the relatively small files on a multi-gig drive is worth it.

<comment><USER4> KeePass in the office is exactly what I'll be doing with the thumb drive version! In my office, the IT staff actually runs scans of your system and goes through reports of what's installed. So to me, this is exactly what I needed.

</comment></comment></comment><comment><USER5> Will this make it possible to have multiple portable installations of dropbox linked to separate accounts for cheap misers (like me) to have more than 2GB of free storage?

(Note, don't actually want dropbox to lose money because of this and hope that they will see this and fix the installer appropriately)

<comment><USER6> If you don't want dropbox to lose money then:

1\. Don't abuse their freemium model

2\. Buy a premium account

<comment><USER5> did you read through what I have written?

<comment><USER4> His message could also be addressed to everyone else reading this thread.

</comment></comment></comment></comment><comment><USER7> For this to be really useful, I would need a way to get strong encryption support (without admin access like installing TrueCrypt).</comment>


Negative Rates: How One Danish Couple Gets Paid Interest on Their Mortgage - <AUTHOR> http://www.wsj.com/articles/the-upside-down-world-of-negative-interest-rates-1460643111 <comment><USER2> Paywalled

Potentially friendly alternatives:

[http://www.australianetworknews.com/mortgage-interest- negati...](http://www.australianetworknews.com/mortgage-interest-negative- denmak/)

[http://www.huffingtonpost.ca/2016/04/18/negative-mortgage- ra...](http://www.huffingtonpost.ca/2016/04/18/negative-mortgage- rates_n_9722138.html)</comment>


Hawking accepts post in Canada - <AUTHOR> http://physicsworld.com/cws/article/news/36899 <comment><USER2> The Perimeter Institute for Theoretical Physics was actually founded in 1999 by Mike Lazaridis, co-ceo of Research in Motion, the makers of Blackberry.

<http://www.perimeterinstitute.ca/>

<comment><USER3> Mike L has donated over 200 million to Waterloo, very impressive.

David R. Cheriton has made some large donations lately too.

Hopefully the funding can continue to help improve facilities and attract great people.

</comment></comment><comment><USER4> Sounds like Interval Research. I hope it doesn't fail after various randomish projects.</comment>


Oh my god, it's a girl (2010) - <AUTHOR> http://micheleincalifornia.blogspot.com/2014/01/oh-my-god-its-girl.html <comment><USER2> Thoughts on the reasons stated:

       1) Attraction: Oh my god, it's a girl and she has a brain
       and is interested in some of the same things I am
       interested in. Maybe I can get a date!

I wouldn't put it past the majority of my gender.

       2) Misguided attempts to encourage women to post more: Oh
       my god, it's a girl and we need more girls posting here.
       Let's be nice and friendly and make her feel all welcome
       and stuff so she will post more (thereby sucking all the
       intellectual content out of their posts and killing any
       reason you have to post there).

I wouldn't put it past HN.

       3) It's not really kid gloves, it's really walking on egg
       shells: Oh my god, it's a girl and what if she breaks
       down and cries because I argued with her (like my
       girlfriend routinely does)

Now _that_ I just can not see.

       3b) or what if I make a joke and she takes it all wrong
       and everyone will think I am some horrible sexist pig!

People have lost their jobs to that one. Even I'm doing that. You would be crazy _not_ to do that

       4) Shyness: A lot of the very intelligent men you find
       hanging out in certain types of online forums (like
       Hacker News) are very introverted and just awkward around
       women and some of them have gotten a lot of rejection, so
       they get nervous once they find out it's a girl.

iffy.

<comment><USER3> It's for your job prospects that you avoid off color jokes? Not the comedic banality or actual disgust with sexism?

<comment><USER4> The "comedic banality" nonsense is tiring.

At least you also said what you really mean, that the sexism is problematic, but far too often I have seen people pretend that their issue with a offensive/bigoted/problematic joke is that it is not funny or cliche^. Let's be honest here, that is not _actually_ what bothers people. We only hear those objections when there is _something else_ wrong with the joke; nobody objects to non-offensive unfunny jokes. Groan perhaps, but not object.

^ _Usually this manifests as something like "it's not even that it is offensive, the joke is just _lazy_"_

<comment><USER3> There's no accounting for taste I suppose. I'll happily wade through a mountain of bad puns, but scatology and sexual dimorphism jokes are just wearisome.

<comment><USER4> > _" scatology and sexual dimorphism jokes are just wearisome."_

Right, but that is not because they are unimaginative or cliched _(evidenced by you being able to wade through mountains of bad puns)_. It is because they are scatological or sexist.

</comment></comment></comment></comment></comment><comment><USER5> The author has a really high opinion of commenters on hacker news. I don't really think it's that high quality. There are all kinds of weird conspiracy theorists, uncritical guffaws and just plain obnoxious toxic commentary. I think it was pretty high quality about one thousand days ago[1], but it isn't anymore. And yes this is a new account, but I'm not new.

[1] [https://news.ycombinator.com/item?id=35079](https://news.ycombinator.com/item?id=35079)

<comment><USER6> I agree. Perhaps the author is remembering the way Hacker News was 3 to 4 years ago.

<comment><AUTHOR> At the bottom of the page it says:

 _(Originally posted elsewhere on 2010 /12/25.)_

I am moving a few things from an old personal blog to a new one. This was previously posted on HN under the old url. I did not expect it to be upvoted this much or get any traction. I just thought a few people might be interested in knowing where it got moved.

</comment></comment></comment><comment><USER7> As a guy, I get pretty sick of it. I've noticed the "kiddie gloves" effect for a long time on HN and so I tend to just stay out of those threads altogether. I've found that if I disagree or critique a woman a thousand misguided defenders swoop in, presumably in some attempt to be chivalrous.

Guys, give it a rest and treat women the same as you would men. They don't want or need special treatment.

<comment><USER8> We must read a different HN and participate in different industries.

> They don't want or need special treatment.

Many women these days are certainly expressing that they want special treatment. The question is if they need it, and if they are representative of women in IT as a whole.

<comment><USER9> I suspect the women who unhappy are writing posts about it, and the ones who don't want special treatment aren't saying anything because they're doing just fine. IMO it's a noisy minority, but given the recent story about the woman who got felt up at a Bitcoin meetup, perhaps more sexist behavior is going on than I see.

I'm a female programmer. I don't want to be hit on or looked at like I'm from another planet; I want to be judged by the quality of my work. It's going to my satisfaction, so I don't feel the need to complain.

</comment></comment></comment><comment><USER10> As an early HN user I secured the username "amanda" before promptly ditching it after 2 weeks. While I don't hide that I am female in my bio, I have also found that the style of interactions changed significantly when I changed my username. Figuring out how to leave the kid-gloves off in real life has been a bigger challenge.

<comment><USER11> Weird, I wonder what percent of HN users are actually looking at a user name when posting a reply, I personally don't even read a username of a person who I reply to, never mind looking for any male/female meanings in it.

But because you posted this sort of comment I actually read your username for the first time :)

<comment><USER12> Of what possible use would a percentage of that be?

<comment><USER13> It is relevant to the subject of the post. (If nobody looks at usernames, then the issue cited in the post doesn't matter.)

Personally, I at least look at who I am responding to (especially when I disagree with them; sometimes the person you're responding to has readily- apparent expertise that you'd feel foolish disagreeing with.)

<comment><USER14> True. I also tend to look at usernames when a commenter annoys me, just to see if it's a troll who is camping out on a thread waiting to say the same things again. But... By then I've made up my mind what I'm going to say, and whether the troll's name is Jack or Jane isn't going to change that.

</comment></comment></comment></comment></comment><comment><USER15> It feels slightly horrible to admit it, but I'd probably try to be more encouraging/nicer to someone who posted something I disagree with if I thought that person was very young, new to the topic, female, or other underrepresented group. The "female" part is probably specific to tech; if it were a forum with equal gender distribution (biotech, or say fans of a tv show or something), I wouldn't.

OTOH, I'd _also_ be similarly polite to a respected person, particularly from outside the field, who posted something wrong. e.g. if a regulator or most VCs said something fundamentally incorrect, I'd politely try to counter it, but I'd back off rapidly unless the disagreement were really core.

All of this is without specific information about the person; there are specific counterexamples. e.g. if pmarca were the VC who said something "wrong", I don't think "back off to be polite" would be useful or necessary; however, he's probably also less often wrong about things.

</comment><comment><USER16> I can't remember the last time I actually noticed a username, or assumed a user was one gender or another.

<comment><USER17> Yep. Other than 1 or 2 people who often post extremely relevant and thoughtful comments and articles; I never "follow" anyone on HN.

<comment><USER18> I notice some usernames but as the parent says you don't know what chromosomes they have ... perhaps they're not even humans ...

</comment></comment></comment><comment><USER19> I find that I try and avoid certain topics on HN, they tend to be clustered around:

1) discussions of gender 2) discussions of gentrification in the bay area 3) financial or political ideology (anything especially randian, for instance)

Interactions / discussion tend to not be as factual or informative as other discussions.

The poster makes great points on how to engage, sometimes, however, good posts are lost within a bunch of noise.

</comment><comment><USER11> > A lot of the very intelligent men you find hanging out in certain types of > online forums (like Hacker News) are very introverted and just awkward > around women and some of them have gotten a lot of rejection, so they get > nervous once they find out it's a girl

Imagine if man posted a similar statement about some female community, he would be called sexist right away...

<comment><USER20> Maybe. You have to keep in mind though that the two situations are not equivalent. Men have been the "in group" for a long time, and as members of the in group there are a lot of social dynamics that we don't tend to have a deep understanding of. See the parable of the old fish asking the young, "How's the water?"

Conversely, as "outsiders" who are greatly affected by the dynamics of the in group, women have had more of a reason to pay attention to the group dynamics of men for a long time. They are more likely to have a sense of these things, conscious or not. The same dynamic happens any time there is a minority. Black people tend to be more astute observers of white people's behavior than the reverse because a white person is more likely to live their life without having to understand how to get what they want from the black folks who have the power, while the reverse is less often true.

</comment></comment><comment><USER21> Many mention they can't think of cases where gender would come up in discussions. While it doesn't often come up, there are some discussions where personal anecdotes leads to the inference of the gender of the author.

Personally, in my AFK life and online, I treat women with the same respect (and critique) as I do men. I also don't know many people who would treat people differently based on their gender. Well, obviously disregarding the case for romance/relations..

I do understand the interest in women in fields like tech and gaming. It certainly is something that can pique ones interest when a person of the opposite gender shares the same interests as you, but that doesn't mean you need to treat them differently unless otherwise hinted.

The only people I can think of that do (treat women the way the OP describes), are also people that are generally awkward in social settings, so it's not gender focused per se, just a bit more apparent there, maybe.

<comment><USER22> Gender discussions seem to arise on here (and almost every other geek/tech/whatever related group) between about one and three times per day. I'm pretty sure we have shared very similar discussions to the topic of this thread at least six other times around here in the last seven days.

</comment></comment><comment><USER23> > At which point, most men will metaphorically go back to affectionately > punching you in the arm like you are one of the guys...

I found this a little troubling. I wish women didn't have to feel like they're "one of the guys" in an online community.

</comment><comment><USER24> I'm going to use this username for a while and see what it's like.

<comment><USER17> I once needed help on a project I was working on (building a lithium iron battery pack out of 18560 cells) and posted as DIYGirl. Got a ton of responses in a relatively less-traversed tech-heavy sub-reddit. If you explicitly state you are female people will treat you different.

<comment><USER24> Ha, I've heard similar stories before. Let's see what happens when I post my next side-project under this account.

<comment><USER15> It's also a great trick for buying domain names.

</comment></comment></comment></comment><comment><USER25> OMG not this again. This has to be the most overinflated topic in tech. Just do your thing, if you're good, nobody cares what sex you are, if you're bad, don't use your sex as an excuse.

<comment><USER26> YES. Women in tech would probably be treated more equally if they talked about ANYTHING other than being a woman. These types of posts do a serious disservice to women.

Show me a woman who has actually accomplished something of merit who also writes about gender inequality. Complaining about inequality is just an excuse for not producing anything of value.

Do you think I star repos on Github based on the sex of the author? NO! I star them based on their utility, elegance, etc.

This issue is a non-issue.

<comment><USER23> [http://en.wikipedia.org/wiki/List_of_feminists](http://en.wikipedia.org/wiki/List_of_feminists)

I would say all of these women have accomplished something of merit while talking about gender inequality.

<comment><USER27> Don't feed the troll. "Controversial" is clearly not trying to have a legitimate discussion, which is probably why they felt the need to register a new user name.

<comment><USER26> Seems legitimate to me. You're the one not trying to have a legitimate discussion. That's why you would attack my username and not the content of my post.

</comment></comment></comment></comment></comment><comment><USER28> From the most recent post:

"I basically think "dating" \-- ie men spending money on women in hopes of getting laid -- is a form of socially sanctioned prostitution."

Why are we wasting time discussing this author?

<comment><USER29> We're not discussing the author but her post.

She may have unusual opinions on dating, but that's not the topic of this discussion.

<comment><USER28> Opinions on dating are opinions on gender, and they're not unusual, they're ridiculous.

I'm male. I consider myself a feminist. It's just as possible to offend me with ignorant statements as it is to offend anyone else, female or otherwise.

<comment><USER30> _Opinions on dating are opinions on gender_

Right, and frankly they're not professional. An in that sense, why are you hung-up on them? Its a bit of a stretch to assume everything that is <not> professional is "un" professional.

</comment></comment></comment></comment><comment><USER17> This thread brings up 2 obvious points: Often minorities are treated differently [and] because of the relatively anonymous nature of the internet, it is difficult to get true demographic information or user statistics.

<comment><USER22> Isn't the whole benefit of the internet that you don't know anything about the other people and can thereby consider them on the merits of their words and actions? I'm not pre-judged by being white or male or fat (and therefore inherently "dumb and lazy") or anything else.

</comment></comment><comment><USER31> Huh, I read lots of comment threads, but I can't say I've noticed anyone using kid gloves to each other around here.

Any stories that had enough instances of this occurring that linking to it wouldn't be unfair?

</comment><comment><USER32> We recently had almost a thousand comments long discussion regarding which 3 letters can form a appropriate program _name_ for female users.

Ask yourself how anyone would feel about that kind of attention.

</comment><comment><USER33> I don't even look at peoples' handles when I reply to them. I suspect a lot us are similar to me in that regard. Also, are men just attracted to women in general, site unseen?

</comment><comment><USER34> Eris makes some good points on her blog: [http://blastar.in/crawfraud/?p=455](http://blastar.in/crawfraud/?p=455)

</comment><comment><USER35> One of the wonderful things about the internet is that no one knows you're a...(something you're not)... unless you tell them.

</comment><comment><USER36> Heads up: mobile stylesheet makes the text black on black. Can't read this easily in Chrome mobile

</comment><comment><USER37> first thing to learn on the internet: a guy is a guy. a woman is a guy. a kid is a fbi undercover agent.

type wiseley

</comment><comment><USER38> I think it's more about the character of the person than the gender.

</comment><comment><USER39> how is one supposed to read that blog!

<comment><AUTHOR> What is your specific issue?

<comment><USER40> Did you just change it? I personally liked the look with the transparent black with white text. Didn't look all that bad to me.

<comment><AUTHOR> Yes, I did just change it. But I am logging off now. So no more fiddling. (I did not expect this to make the front page. It is a repost. I figured it would be completely ignored, or I would not have done it late in the day before logging off.)

Later.

</comment></comment></comment></comment><comment><USER6> 1\. Hacker News usernames became a blur of random characters quite some time ago. I don't know how I'd begin to tell what gender you all are, and it never enters my mind. 2. I really don't think there are that many people who care whether you're carrying the batter or the oven. 3. I don't know how to say this nicely, but you - not your gender, but you the individual - are sort of known to be a little sensitive to this, in a way that comes off a bit attention seeking. If you feel this is your message to bring, then great. More power to you, really. Just saying, this seems like one of your things.

<comment><USER4> Eh, while on most sites I completely ignore usernames, I actually do read usernames habitually on HN. The community is small enough and there are enough frequent users that I find recognizing usernames to be helpful in understanding where somebody is coming from.

</comment></comment><comment><USER26> Noone ever seems to bring up the fact that sex and gender are NOT the same thing.

sex - either of the two main categories (male and female) into which humans and many other living things are divided on the basis of their reproductive functions.

gender - the state of being male or female (typically used with reference to social and cultural differences rather than biological ones).

<comment><USER41> thank you for the sociology 101 lecture</comment></comment>


How fake news led pope to bless England's Irish invasion - <AUTHOR> http://www.irishtimes.com/culture/books/how-fake-news-led-pope-to-bless-england-s-irish-invasion-1.3120786 <comment><USER2> Can we stop using 45's language, please? We need to separate satire, propaganda, disinformation, and plain old lying from this term. Because when we allow it all to be grouped under "Fake News", it allows him to give the weight of those things to information which he simply doesn't like. And that, more often then not, is not fake in any way.

</comment><comment><USER3> Ugh, "fake news" is probably the worst term to come out of 2017. Blanket statements like this are usually more dangerous than the actual content that is being described whether or not it's "fake".

</comment><comment><USER4> "How fake news was pretty much the cause of all wars, ever." \- at least in terms of tricking the population into going along with them.</comment>


Ask HN: Does web language/framework affect acquisition chances? - <AUTHOR>

Let's say I'm choosing between learning and coding a web app with RoR or Python/Django.<p>Does the choice affect acquisition chances? For instance, would google be more likely to acquire a Python/Django startup? <comment><USER2> If your goal is to be acquired by Google, writing the app in Python won't hurt your chances as there is more resident knowledge of it (for front-end) than RoR in-house. This also has implications on the integration of the app with their product suite. On the flip side, depending on how complicated your app is, there is also a chance a Google engineer could reverse engineer and integrate it in their sleep (or 20% time) -- especially at the sensitive phase of growing the product.

Perhaps some alternate questions: Which will get you to create your app as close to your initial version 0.1 in the least amount of time so you can test your assumptions about the market?

Which community will you learn the most from and is the next logical step from where you are now as a developer?

Which will reinforce core computing concepts with a decent framework to resist the temptation to give up out of sheer frustration?

</comment><comment><USER3> It probably can. I bet if you're using Python (well) the Google tech guy that reviews your tech and team is going to give a much more favorable review than if you were using PHP. So it probably can help a lot in talent acquisitions at least.

If you're a really successful company and the acquirer _really_ wants to buy you it probably doesn't matter at all.

I certainly wouldn't choose a language based on acquisition hopes myself.

</comment><comment><USER4> Use whichever you're most productive with. Worry about making a great product.

</comment><comment><USER5> > Does the choice affect acquisition chances?

Yes, but not the way you think.

If you don't ship something that gets users, you won't be acquired.</comment>


Ask HN: A porn-like site stole my [firstnamelastname].com domain. What to do? - <AUTHOR>

I accidentally let my personal domain name, myfirstnamemylastname.com expire, and a Japanese porn-ish site immediately scooped it up.  That was over a year ago, and they still seem to own it.
It doesn't make sense for them to have it, since I have an obscure Eastern-European name, and it's just that with a .com on the end.
This looks bad when potential employers, clients, and friends Google/search me.  Instead I bought myfirstnamemylastname.ca (I'm Canadian) and myfirstnamemylastname.info, but the .com is still porny.
I want my domain back, but I don't want to launch/pay for huge legal proceedings.  I certainly don't want to pay the Japanese company a ransom.
What's the simplest thing I should do?
This has been a thorn in my side for far too long, and I'll really appreciate your suggestions.  Thanks in advance guys! <comment><USER2> Either offer them some money or deal with it I guess.

You have no real right to your name as a domain name... If you let them buy it before you or let it expire, that's your loss unfortunately.

<comment><AUTHOR> Wouldn't Apple or Google be able to prevent others from stealing out their domain names from under them? Wouldn't Steve Jobs or Bill Gates be able to? I don't know the law with regard to this, so I wonder if you're right, and there really is no resolution process.

<comment><USER3> That is because they have trademarks that most courts would accept, noone has a trademark on their name. Well not normally anyway</comment></comment></comment>


Planned Parenthood, planned "hacking"? - <AUTHOR>

Starting with the body tag with a suspicious attribute: `data-page-category="Under Attack Campaigns"`

    <body class="site_down_template no-write edit-disabled" 		 data-page-category="Under Attack Campaigns" 		 data-page-type="Site Down Template" 		 ontouchstart="">
 The headline on the main page has since removed the text "Our site is down due to extremists", but the phrase still remains in some metadata in the head:

    <meta name="title"
          property="title"
          content="Our site is down due to extremists :: Planned Parenthood"/>

 An image has since been removed:

    <meta name="og:image"
	      property="og:image"
	      content="/images/planned_parenthood_is_under_attack.png"/>
 Reports that Planned Parenthood tweaked CSS and changed their story on Facebook multiple times:
http://thefederalist.com/2015/07/30/planned-parenthood-hacking-sure-looks-like-an-orchestrated-pr-stunt/ <comment><USER2> Zero Hedge compiles a bunch of evidence, too.

[http://www.zerohedge.com/news/2015-07-30/did-planned- parenth...](http://www.zerohedge.com/news/2015-07-30/did-planned-parenthood- just-hack-its-own-website-publicity-stunt)

</comment><comment><USER3> It just seems odd that these "extremist" hackers only made it easier for people to donate to Planned Parenthood in this time of "crisis."</comment>


Show HN: Epiloge – Community for work and knowledge sharing - <AUTHOR> https://www.epiloge.com <comment><AUTHOR> Hey all,

We've been building a webapp that is pretty much a mash of Medium.com and a social network. The core feature is a multimedia writing tool to write about something you built or publishing a paper or presentation - e.g. a github project.

Cheers, Axel

P.S. the idea for it came from us having had projects, presentations and papers at uni and during work that ended up collecting dust on our harddrives, even though tons of work went into it.</comment>


Just did the Y Combinator interview: here are my notes - <AUTHOR> https://blog.checklyhq.com/just-did-the-ycombinator-interview-here-are-my-notes/ <comment><USER2> > Order your thoughts. Keep it short. Communicate one idea in one sentence. > etc. etc. etc.

This is true in general. I remember when I did consulting interviews you needed to talk like that and the feedback I got was that I didn't do enough of it.

Funnily enough, I could clearly tell that whenever I had a programmer job interview, everyone was always really impressed with how 'structured my thinking' was.

Other than being impressed the biggest benefit that you also describe in your blog post is that it is simply very clear what you are about! And people seem a lot happier when listening to you feels like a simple thing to do.

Here's an example of how I do it. The following that I wrote down was typed as quickly as possible.

\---

Interviewer: So tell me about yourself

Me: Alright, there are three perspectives I'd quickly like to touch:

1\. Personal

2\. Educational

3\. Professional

With 1. personal, I'm all about fantasy and curiosity. Understand that and you understand me.

Educational: I studied to become the bridge between the business world and the computer world while also trying to become an expert in both. Therefore, I started of with business informatics. Upon graduation I immediately started studying psychology - people, and computer science - computers. And I studied game studies to merge them back into one topic again.

Professional it's rather interesting: the past 8 years I saw my university as a playground and I just applied to any job that didn't feel like work. This resulted in me becoming a teaching assistant, a coach for teaching assistants, a bootcamp instructor and a programmer/web developer. In total I have about 2.5 years of work experience, 1.5 on teaching development and 1 on development.

\---

It was a huge improvement compared to my standard 15 minute answer. This answer above is just told under 1 minute.

<comment><USER3> > Interviewer: So tell me about yourself

> Me: Alright, there are three perspectives I'd quickly like to touch:

> 1\. Personal

> 2\. Educational

> 3\. Professional

That seems so forced and unnatural that it makes me cringe. 'Tell me about yourself' should be a natural conversation starter, not an exam that you did your homework for.

<comment><USER4> Same here. If I heard this in an interview I'd feel like I'm being fed a presentation deck instead of an honest answer.

Now, I do think that one should do a little bit of homework to give a somewhat structured answer to "Tell me about yourself", but there is such a thing as too perfect, at which point it becomes jarring.

<comment><USER5> Have you tried Amazon interview questions? They expect you to follow the STAR method.

<comment><USER2> Twice, other than that no. In most behavioral programming interviews I haven't been structured in my answers as being structured came a bit later when I was also applying for consultancies. I was a lot tougher to follow when I wasn't structured.

When I was structured I did use a variation the STAR method when they expected me to. Having a method like that makes things quicker to go through, as long as you make it your own and own it. I adapted the framework a bit by swapping the T (Task) for P (Problem) as it sense to me why you'd need to emphasize the task as opposed to the problem you'd be trying to solve. In rare cases I also adapted it to the SPARAR method, since the result made the problem smaller but didn't fully solve it yet.

I prefer to structure things on the fly though without a pre-defined framework.

</comment></comment></comment></comment></comment><comment><USER6> I'm sure other commenters here will comment on the substance of what you wrote.

I'll, however, just toss a complement: You're a fantastic writer. Pithy, funny, informative. Nice work here.

<comment><AUTHOR> Thanks. I try. Some come out better than others.

</comment></comment><comment><USER7> Haha, I thought I am the only one who joined the startup school this year mostly for the AWS credit, honestly the credits helps, being from African developing country, AWS charges are a bit expensive for us to expirament with and build a startup. I am glad we are not alone in the AWS credits wagon.

</comment><comment><USER8> >I have no idea if Checkly is "in" yet — I'll find out within a week or so

Is this delay only for interviews outside the Bay Area?

<comment><AUTHOR> Honestly, I don't know. I thought 5 days to a week was pretty good already.

</comment></comment><comment><USER9> 3 interviewers in a single 10 minute interview, correct?

Surprised they don't have 2 for 15 or 1 for 30 min.

<comment><USER10> They want to avoid the unconscious bias of a single mind, and non decision due to conflicting opinions of even number of interviewers.

<comment><USER11> Presumably there's more to this than comes across in your comment.

After all, you don't avoid the unconscious bias of a single mind by adding more minds. That just gives you three sets of unconscious bias and _adds_ biases caused by group dynamics.

Do you have a link? I may be googling the wrong terms.

<comment><USER12> You can still avoid most of the effects of a worst-case bias by adding two additional measurements.

Rather than 1 person, 30 minutes (one measurement), given 3 who all had the same experience, you are less likely to have all three have an impression unconnected with the substance of the conversation.

<comment><USER11> > _You can still avoid most of the effects of a worst-case bias by adding two > additional measurements... given 3 who all had the same experience_

You're right that it's an advantage, but it reduces noise, not bias.

Bias by definition skews systemically in the same direction so the positive effect of taking multiple measurements is minimal.

<comment><USER12> Each bias skews the same direction for each person, but not every bias is in the same direction for individual people. (Some people are biased in favor of Harvard/Ivy League graduates. Other people are biased _against_ those exact same candidates. Bias is _not_ by definition unidirectional for all people.)

The YC partners are _trying to be_ similarly biased against entrepreneurs who (they believe) will not be successful in the program.

They are much less likely to be similarly biased against irrelevant factors like accents, mannerisms, backgrounds, etc.

<comment><USER11> > _They are much less likely to be similarly biased against irrelevant factors > like accents, mannerisms, backgrounds, etc._

They're not less biased, they just average out their biases over the group.

Your assumption is that three people chosen from a fairly homogenous pool are going to cancel out each others biases, which is... optimistic.

I don't know from this conversation what they're actually doing, but what they _should_ be doing is using a diverse set of opinions to create a fixed set of questions and a fixed marking scheme, and then sticking to it for that round of interviews. Then looking back over time at every interview question and analysing how well it predicted later outcomes.

<comment><USER12> If you think they're sub-optimizing because of biases and a poor process, maybe that represents an opportunity for you or someone else to use your method to outcompete them.

Their track record suggests they're doing pretty well.

<comment><USER11> So your argument is that they should be above examination of their interview process because their investments are doing well? Come on, you're just arguing for the sake of it now.

Multiple independent assessments are great at reducing random noise. Bias is noise, sure, but it's by definition not random so you need other forms of intervention to counter it.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> I get the impression from reading stuff like this, there have been several I have read, that for some people start ups are a fashion or a "thing to do". I find this very strange as though some people have money and time to burn without the stresses of daily life of things like a demanding job or children.

To me a startup makes amazing sense when you have an original disruptive idea and the passion to unload all your time and energy into the spirit of that idea knowing you will probably fail. That is the anti-thesis of a fashion.

<comment><AUTHOR> OP here. Fair enough, but I'm 100% all in. I'm as far away from a startup fashionista as they get: trust me. I just like sharing this stuff for catharsis reasons and because I genuinely think it's interesting to read for some.

On the disruption part, I disagree. There are markets that are just old or aging. Fairly small improvements and a rethink of the market can already make a new product viable.

<comment><USER14> A startup is fundamentally disruptive. That's what a startup is: something that grows until it can't be ignored.

I just tried to think of a single successful startup that wouldn't be classified as "disruptive" and couldn't do it.

<comment><USER15> I think you're confusing a startup with a startup unicorn. You can start tomorrow a niche SaaS, e.g. a debt collection CRM for French market, and become a startup.

Are you successful startup? Yes (e.g. you turnover $20k a month solo). Are you disruptive? No.

Truly disruptive startups are in two digits range. Successful startups that "made it", whether it's revenue, money raised, or profit, are in the hundreds of thousands/millions.

<comment><USER16> According to YC (at least Paul Graham's classic definition) a startup is something that grows very fast.

</comment></comment></comment></comment></comment><comment><USER17> _> I was interviewed by three partners _

Who? They are people, right? I have a name, you have a name, the three partners must also have names. Who were they?

<comment><USER18> He probably doesn't want to share that level of detail. Why is this important?

<comment><USER17> Thanks for asking.

The specific names of the three judging partners aren't important (obviously) what is important though is that there is a tendency to provide those in position of power (generally, or in a given situation) with a layer of protection (by anonymity) that is not afforded to those whom they have power upon.

The omission caught my eye.

It reminded me that YC has this glaring asymmetry in other parts of the application process, specifically with the personal video they require people submit, but do not disclose who watched it.

I thought that if I say something, someone might ask a followup question, and I can bring that point above in a followup comment.

So again, thanks for asking ;)

P.S - the downvotes on the comment are worth it, obviously.

<comment><USER19> > The specific names of the three judging partners aren't important > (obviously) what is important though is that there is a tendency to provide > those in position of power (generally, or in a given situation) with a layer > of protection (by anonymity) that is not afforded to those whom they have > power upon.

If the author hadn't posted about this experience, no one at YC would've made a public post saying they interviewed him.

Indeed, that would be a bit on the weird side if YC made a post saying "we spoke to someone from Checkly, his sense of humor was kinda funny."</comment></comment></comment></comment>