Show HN: Get encrypted data from people that don't know how to encrypt - <AUTHOR> https://github.com/whitesmith/hawkpost <comment><USER2> A contact form that is hosted on a HTTPS protected website already does the job. The main difference is that it is usually (but not necessarily) only transmitted encrypted, not stored in encrypted form.

Here's a tip: If you generate an email from the content of the contact form anyway, why not make it an encrypted mail? It's rather easy if you use mailx from the heirloom-mailx package that is part of Debian, Ubuntu and probably a lot of other Linux/BSD/UNIX distributions. Here are the required steps:

In ~/.mailrc:

       set smime-ca-dir=/home/user/smime

       set smime-ca-file=/home/user/smime/1_Intermediate.crt

       set email@example.comfirstname.lastname@example.com

Then every mail sent to email@example.com using "mailx" will be encrypted using S/MIME.

Got no local MTA installed? You can make mailx send the mail directly via SMTP:

$ echo mail body | mailx -s "subject" -S smtp=mail.example.com:25 -S smtp-use- starttls email@example.com

<comment><USER3> That's still vulnerable to coldboot style attacks. If the data is never unencrypted unless you're readining it that's technically safer. But yes you are right that would work as well.

<comment><USER2> Hawkpost (the project introduced here) is also vulnerable to a coldboot attack - if the server that sends the page with the javascript is compromised, all bets are off.

<comment><USER4> You need to trust the server at some point. Assuming you do then it doesn't matter if the at-rest encryption is done in the browser or on the server.

I'd be happy with HTTPS upload and PGP encryption before writing to disk or forwarding. I think the biggest risk of a secure upload server is a vulnerability exposing a disk full of secure content in the future.

<comment><USER5> Your don't need to trust the server. You can implement subresource integrity checks!

<comment><USER6> Subresource integrity still requires you to trust the server sending the hashes.

<comment><USER5> Ok so publish the hashes on a blockchain and have the client verify them there

<comment><USER7> Not a bad idea, but this isn't a thing browsers currently do, and the average person can't do that with ease. Especially considering this web app is aimed at non-tech savvy individuals.

<comment><USER8> Make the whole page hosted on IPFS, and make your DNS point to it. Then you just need to trust the DNS. So use namecoin.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> The weakest link I can identify here is MITM attacks when you're sending the link.

Imagine:

      Alice generates a link.
      Sends the link to Bob over an unencrypted/unauthenticated link.
      Mallory intercepts the link. Generates his own link and send that link to bob.
      Bob enters the confidential information on Mallory's link.
      Mallory sees the confidential information, and then sends it to Alice's original link.

The only way to prevent this type of attack is sending the link over a secure channel. But if you already have a secure channel - what's the use case?

<comment><USER10> >But if you already have a secure channel - what's the use case?

You can use Whatsapp, or some other E2E-encrypted service that is easy to use, and then transmit the sensitive data over encrypted email, which is more convenient for long-form text.

<comment><USER9> Personally, I find the Whatsapp web version pretty convenient for long-form text

<comment><USER4> For text yes, but not so much for sending attachments like documents or other arbitrary files.

</comment></comment></comment></comment><comment><USER11> Hi, I'm one of the contributors of the project and we started this because of the need to deal with clients sending us information through insecure channels. We have been using it for a while at Whitesmith and it entered our team's workflow smoothly.

Please feel free to ask any question and I will try to answer the best I can.

Note: The project is open-source so you can self-host it. Contributions are welcome.

Edit: to fix typo

<comment><USER4> This is a great idea but I often have this problem the other way around.

I regularly want to send encrypted data to companies that don't know how to decrypt it. The number of firms that ask for sensitive info to be emailed across (or not much better - use dropbox) is crazy.

Anyone got any good solutions to this?

<comment><USER12> Does a password-protected zip file work?

<comment><USER4> This is the most basic step, but even this is non-trivial. There are multiple ways of password protecting a zip, ZipCrypto is insecure and not all software supports AES-256. Self-extractors will get stopped by AV and sometimes even password protected zips (as the AV can't read them).

You then have to communicate the password out-of-band, as emailing it would defeat the purpose. It may be hard to read over the phone and you have to trust it was not written down and the file is not then stored/forwarded unencrypted. Explaining the process to someone non-technical may be challenging.

Symmetric crypto is a mess, asymmetric would be great if secure key exchange could be easy. If only the software was as ubiquitous as zip handling is in the OS.

<comment><USER13> Microsoft solves this with RMS for Individuals: [https://portal.aadrm.com/](https://portal.aadrm.com/) (also called the RMS Sharing App, now getting rebranded to Azure Information Protection).

The recipient's identity is the key to opening the content - no need to communicate anything out-of-band. Depending on the file format chosen, you get DRM features limiting granular actions on the file beyond view/edit.

To open the protected files, your recipients will have to download/install the (free) app from Microsoft. This is generally pretty painless.

Definitely worth checking out, especially good for consultants' workflows.

<comment><USER4> This actually looks like it might be the least-worst solution, thanks!

This is the product page: [https://www.microsoft.com/en-us/cloud- platform/azure-informa...](https://www.microsoft.com/en-us/cloud- platform/azure-information-protection)

</comment></comment></comment></comment></comment></comment><comment><USER14>
        >  or use the official server (that is running an exact copy of this repo)

Is there any project that attempts to prove claims like this?

I don't know what that would look like; it would probably just move the point of trust, just interested to see it if such a thing exists.

<comment><USER15> What you are looking for is called "remote attestation".

(In open source software the solution to this problem is "well, you could always just host your own instance" ;))

<comment><USER14>
        > In open source software the solution to this problem is
        > "well, you could always just host your own instance"

That doesn't always work though - end-users can't trust you more because you host it instead of using the version hosted by the OSS team for whom it's the main focus. (Arguably they should actually trust the latter more!)

Consider Keybase for example. If someone builds a service on top of Keybase, their end-users can't trust them with their private keys* if they host it themselves instead of using upstream hosting.

*I know this is not required in order to use Keybase - I use it with gnupg and keep my keys local. It's the easiest example of needing to trust Keybase, though.

</comment></comment></comment><comment><USER16> This is actually an extremely common kind of enterprise security product --- though none of them do the Javascript/PGP dance.

Enterprise security teams know, of course, that email is insecure, and that partners and clients want to send sensitive stuff via email. So they buy these products and stand them up, and then instruct their partners to follow a link to upload their documents or sensitive emails, rather than using their email client.

The box itself forwards the email to user inside the enterprise.

I think there's something useful here, but, like 'Tepix said: a simple form on an HTTPS site is already doing 99.999% of the useful work here (that's all the expensive enterprise products do, too).

A direction you can take this to be even more useful is to strip and sanitize attachments, as a way of quarantining malicious email.

</comment><comment><USER17> Like several others I made a similar tool years ago : [https://transfer.pw/](https://transfer.pw/)

It uses client side encryption, dyn. created keys, and the message is deleted after first retrieval.

A slightly different usecase than the OP, still using it for all my clients.

</comment><comment><USER18> Similar project [https://encrypt.to](https://encrypt.to)

<comment><USER19> This is handy but I don't find it particularly pleasant that my email address would be written in plain text on the web page. A service like keybase.io helps with the key discovery and encryption part while not revealing my email address in such a way.

</comment></comment><comment><USER20> I built something like this in 2015 that didn't gain a ton of traction: [https://privateforms.com](https://privateforms.com)

<comment><USER4> That looks cool. I think you might get better traction by selling it to businesses such as solicitors and brokers. You could white-label it with their branding and host it for them on a sub-domain - upload.low-tech- accountants.com.

<comment><USER20> Yeah, it's hard to find a market for this.

One unique proposition that Private Forms has is a form-builder so you can create custom forms rather than just contact forms.

</comment></comment></comment><comment><USER21> If you can get the library to the sender's browser without security problems then it probably can securely encrypt the text and send it to the target. But is it always secure to send someone the library that you want to use?

<comment><USER11> Your point is valid and the project should always run through HTTPS (with HSTS). All assets are served from the local server.

</comment></comment><comment><USER22> js crypto's trust problem isn't solved yet. One has to trust hawkpost.co to not serve compromised client side js.

<comment><USER23> Yes, there is no JS source signing in the browser yet. Then again, do you check the (compiled) code that is delivered to you via source repositories with which you sign/encrypt your GPG messages? How many people read the OpenSSL source code? How trustworthy are the signatures on Debian packages?

<comment><USER24> What about SRI?

"Subresource Integrity (SRI) is a security feature that enables browsers to verify that files they fetch (for example, from a CDN) are delivered without unexpected manipulation. It works by allowing you to provide a cryptographic hash that a fetched file must match."

[0] [https://developer.mozilla.org/en- US/docs/Web/Security/Subres...](https://developer.mozilla.org/en- US/docs/Web/Security/Subresource_Integrity)

<comment><USER25> SRI is a great way to make an html page that loads all the js from a server, tell the user to store that locally, and be sure that the loaded js files will never change (otherwise they won't get loaded).

<comment><USER26> Why not just store all the js locally too?

<comment><USER25> Purely for UX, it's easier to say "save the page you're currently viewing" than "save this page and also these files". It's not a huge difference, though, as you noted.

</comment></comment></comment></comment></comment></comment><comment><USER27> Here's another very similar project:

[https://github.com/Spark-Innovations/SC4](https://github.com/Spark- Innovations/SC4)

Live demo:

[https://sc4.us/sc4/sc4tk.html](https://sc4.us/sc4/sc4tk.html)

SC4 has been through a security audit.

</comment><comment><USER28> Looks great, this is something that is missing from Keybase (specifically, the email sending part).

<comment><USER29> Hi, one of Hawkpost contributors here.

We actually use Keybase as well, and that was one of our inspirations for the exact same reasons! Since one of our main use-cases was to receive secure data from non-tech-savvy people we wanted to remove as much friction as possible, and that included sending the encrypted blob. We're actually thinking of ways of integrating Hawkpost with Keybase.io, namely fetching/verifying keys (as we already do with keyservers).

</comment></comment><comment><USER30> Ha, the use-case reminds me of something I wrote a few months back.

A complete in-browser RSA encrypted message sharing for one-time use. Like transferring passwords via unsecure channels (aka Skype).

It generates a keypair in the browser (offline) and guides also unexperienced users through the process. Frankly, its a dirty hack, but it does the job haha.

[http://tomw1808.github.io/rsa-message- sharing/#/](http://tomw1808.github.io/rsa-message-sharing/#/)

</comment><comment><USER31> This is really smart, especially with something like protonmail.

</comment><comment><USER32> Not sure if I understood it correctly, but in essence it lets your users enter some (secret) content which is then encrypted in the browser using PGP.

Except for the message signing and auto-emailing, I've implemented something similar:

Blogpost: [https://0day.work/easy-pgp-composer-encrypting-pgp- messages-...](https://0day.work/easy-pgp-composer-encrypting-pgp-messages-in- your-browser/)

GitHub: [https://github.com/gehaxelt/PHP-Easy-PGP- Composer](https://github.com/gehaxelt/PHP-Easy-PGP-Composer)

Demo: [http://pgpcomposer.demo.0day.work/](http://pgpcomposer.demo.0day.work/)

</comment><comment><USER33> I usually use a burn-after reading paste in 0bin.net for that, but I like the idea of sending an email. Altough it could be use for spam don't you think ?

<comment><USER11> That was one of our concerns, to receive information you can setup different "boxes" with an expiration date. Each box as an hard to guess url (such as [https://hawkpost.co/box/19f1e7b9-f200-47ec-b5ff-918a9483a546](https://hawkpost.co/box/19f1e7b9-f200-47ec-b5ff-918a9483a546)), so only the people you shared it with, will know how to access it.

You can also set the maximum number of messages you wish to receive through that box.

I think these measures will help users avoid spam.

</comment></comment><comment><USER34> This is excellent and very helpful for my volunteer work.

</comment><comment><USER35> I feel like you could knock out something similar to this using Vault, from hashicorp.

<comment><USER11> Vault is an awesome tool, but I'm not sure if it lets an "outsider" submit information in an easy way.

Some sort of integration with vault looks like a nice idea.

</comment></comment><comment><USER36> Python and PostGreSQL. Not exactly a tiny footprint for a tiny application.

<comment><USER37> C and flat files would've been a clearly better choice, I agree.

<comment><USER38> Whoa, Whoa... assembler and raw drive access only...

</comment></comment></comment><comment><USER39> I'm curious, when is this level of security necessary for civilians?

<comment><USER40> Always. All the time. Every day.

Lest your unencrypted messages one day be used in a fishing expedition to facilitate oppression at the hands of the current political regime.

</comment></comment><comment><USER41> How is this different from e2e-encrypted webchat?

<comment><USER42> its store-and-forward?

<comment><USER11> on hawkpost the encrypted blob only goes through the sending queue and is never stored permanently on the machine.

</comment></comment></comment><comment><USER43>
        $ echo "Hello world" > message.txt
        gpg --sign message.txt

        $ gpg --verify message.txt.gpg
        gpg: Signature made Wed 19th october 2016, 12:19:19 CEST using RSA key ID D9AE6E9E
        gpg: Good signature from "John Smith <email@example.com>"

        $ echo "evil" > message.txt

        $ gpg --verify message.txt.gpg
        gpg: Signature made Wed 19th october 2016, 12:19:19 CEST using RSA key ID D9AE6E9E
        gpg: Good signature from "John Smith <email@example.com>"

<comment> martin-adams I don't think I'm smart enough to infer what you're trying to say. Care to elaborate?

<comment><USER25> He's saying that, even though he changed the message, the signature still validated. He doesn't realize that the resulting GPG file contains the message, so it's verifying it against its own, stored copy.

<comment><USER44> I think _dvh_ is confused about detached signatures and signatures that contain their payload.

For detached signatures:

        gpg --verify message.sig message

For signed files:

        gpg --verify message.sig
        gpg --output message --decrypt message.sig

It's all documented¹.

Dvh: what are you getting at?

1: [https://www.gnupg.org/gph/en/manual/x135.html](https://www.gnupg.org/gph/en/manual/x135.html)

<comment><USER43> I'm just trying to point out that it is easy to make mistake by checking normal signature and detached signature.</comment></comment></comment></comment></comment>


Funding Open Source: How Webpack Reached $400k+/year - <AUTHOR> https://medium.com/open-collective/funding-open-source-how-webpack-reached-400k-year-dfb6d8384e19 <comment><USER2> >> fuck webpack

>> sorry to hear you feel this way! [..]

>> [..]

When I first read the quote, I thought "that's nice of webpack". Then I saw this:

> The greatest power you have for haters or trolls is love.

I would not call someone saying "fuck webpack" a hater or a troll, I would call them a frustrated user. OTOH, you can turn a frustrated user into a hater or a troll by dismissing their concerns or by trying to shift the blame onto them by calling them rude.

Venting your frustration is an absolutely understandable behaviour when faced with unintuitive software, especially for users who don't understand what they're using (including software developers!) - they're in a position of lesser power, feel helpless, and need an outlet to express this. No developer should be taking these expressions as a personal attack, nor belittling it as rude or trolling.

Because of this, I saw the original quoted interaction in a new light - upon a second look, it is a bit unsubstantial, bordering on virtue-signalling. A proper quote that _actually indicates_ caring about your users, would include responding to a specific problem from a very frustrated user, by _actually fixing the issue_. Not just saying nice words.

<comment><USER3> I don't think it's acceptable in any situation to express your frustration this way in a public forum, especially for OSS. Thoughtful critical pieces are fine and necessary, but I don't think blatant vitriolic "cathartic" outlets should be encouraged at all -- in this case, it is being encouraged by the maintainer, but I don't think that helps anything.

I get the frustration...I've said "Fuck XYZ" a thousand times for a thousand different software XYZs but to take that to a public forum is suitable behavior for a toddler, and does harm.

How many nights & weekends were spent building Webpack? How many nights & weekends coming up with "fuck webpack"? Show some respect and at least spend a few hours in thoughtful critique. Civility must still have a place, even online.

Tangentially, Rich Hickey recently responded (I think appropriately) to a similar outlet re Clojure [1].

[1] [https://www.reddit.com/r/Clojure/comments/73yznc/on_whose_au...](https://www.reddit.com/r/Clojure/comments/73yznc/on_whose_authority/)

<comment><USER4> I agree that screaming something like this on Twitter when you're in temporary rage is nothing but childish. But it's also hard to ignore that someone who represents webpack was able to resolve the situation calmly and civilly only to call the person a hater and a troll later on. This, in my eyes, is a breath away from screaming obscenities on Twitter.

</comment></comment></comment><comment><USER5> The difficulty I have with Webpack is that there does not seem to be any unifying principle of how things work.

The stream model of gulp and the resulting highly structured code that most often results means that I can generally find and fix bugs quickly, this is even possible in the horribly convoluted gulp file that we use at my current working place. In my experience when you have even a bit of webpack and there is a problem somewhere it can be difficult to figure out the cause because it seems every capability of the system works in its own way.

<comment><USER6> Completely agreed. Webpack faces the exact issue that Grunt ran into which is these huge 'config files of doom' that end up as snowflakes which are hard to understand.

Rather, defining the build process entirely in code lets you step through the whole thing logically.

<comment><USER7> I don't find that to be true at all. In fact I would guess that across all my projects the configs are 80-90% identical. The only thing that changes are different loaders depending in the tech stack and maybe the addition of a few bells and whistles such as i18n.

</comment></comment></comment><comment><USER8> The state of Webpack does not reflect a 400k/year budget. The docs, API, source code, ecosystem... so happy to hear people making software engineering money get a second salary to keep doing this.

We're all waiting for the thing that will replace Webpack so we don't have to keep using it. Maybe we should just go and make it.

<comment><AUTHOR> I think it does. This area where webpack is trying to shine is just over- complex, so the tool can't be simple, that's it.

And most importantly as for me, developers who works full-time on such projects can sustain the higher quality and improve it over time and if you chose it for now it may been relevant year later or 2-3... I hope at least.

<comment><USER9> The tool aims to be agnostic to work flow it's a trade-off to be generic in our case. We realize it too.

</comment></comment></comment><comment><USER10> "Ever since we were able to grow the budget large enough for Tobias to work on Webpack full time..."

This is what the open source community needs. Steal the maintainers of the top 1% of open source projects from the "free market". The projects not already sponsored by corporations that is.

Or, why not work toward pairing these maintainers w/ companies who will let them spend most of their time working on said project. Might make it easier as far as fund raising is concerned.

I bet there's a niche for this second idea. It's not always obvious to the people cutting the checks just how valuable these side projects are to the world.

</comment><comment><USER11> Nice to hear there's some hope... I managed to get some small grants and donations and things for WireGuard over part of this last year -- [https://www.wireguard.com/donations/](https://www.wireguard.com/donations/) \-- but I don't have much lined up for next year, and I'm hoping I can figure it out in time to do WireGuard things full time. The thing is just getting funding lined up for [part of] this last year was a pretty time consuming hustle, and I'd rather spend that time writing code. This leads me to think I should find somebody to handle "fund raising" or "community mumblemumble" or something, but as WireGuard is a security-oriented project, communicating correctly is important, and I could imagine that somehow backfiring. The other thing is that I'd feel really uncomfortable putting up one of those thermometer overlays on the wireguard.com website; just adding the "donate" link in the corner was a bit much for me. So, hm. Nice to see the Webpack guys figure it out. Maybe I'll take some clues from there.

<comment><AUTHOR> Here is one more success story nowadays about Vue.js and Evan You (creator)

\- [https://medium.com/the-vue-point/vue- in-2016-8df71d98bfb3#9a...](https://medium.com/the-vue-point/vue- in-2016-8df71d98bfb3#9af5)

> _Going Independent_

> In early March I decided to work on Vue full-time independently and started > a Patreon campaign, which has been (to my surprise) quite successful so far. > It is my first time working independently without having to report to a > manager, and it has been a very liberating experience.

They also use OpenCollective: [https://medium.com/the-vue-point/vue-is-now-on- opencollectiv...](https://medium.com/the-vue-point/vue-is-now-on- opencollective-1ef89ca1334b)

</comment></comment><comment><USER12> It's a great project but I don't understand why they need so much money for the future. It's a bundling tool. Wasn't it supposed to be a transition project? Won't Webpack get replaced by simpler things like ES6 module import and HTTP2 push?

It was the same thing with CoffeeScript; it inspired some neat features in JavaScript but it has made itself obsolete; the ecosystem caught up. It fulfilled its purpose nonetheless.

Webpack would probably have benefited more from this funding a few years ago.

<comment><USER13> No, HTTP2 doesn't just replace bundling, and definitely not what Webpack does.

Based on what I've read, sending a few bundled chunks instead of many individual module files will still generally have less overhead. In addition, Webpack's ability to load and transform other file formats like images and styles is something that simply requesting ES modules over HTTP2 can't deal with. Webpack's ability to code-split an application is also important.

Tobias Koppers, the main Webpack developer, wrote an article last year on how Webpack and HTTP2 relate: [https://medium.com/webpack/webpack- http-2-7083ec3f3ce6](https://medium.com/webpack/webpack-http-2-7083ec3f3ce6) .

It's also worth noting that Tobias had only been able to work on Webpack intermittently for the last couple years, until this recent funding allowed him to work on it full-time. Tobias has been writing reports on what he's been doing [0]. Also, grants and full-time development is enabling the team to work on projects like integrating WebAssembly support directly into Webpack [1].

[0] [https://medium.com/webpack/the-chunk-graph-algorithm- week-26...](https://medium.com/webpack/the-chunk-graph-algorithm- week-26-29-7c88aa5e4b4e)

[1] [https://medium.com/webpack/webpack-freelancing-log-book- week...](https://medium.com/webpack/webpack-freelancing-log-book- week-17-48233121afbe)

</comment></comment><comment><USER14> So TL;DR: tshirts, ads embedded in their docs, and corporate sponsorships. Makes sense for an open source project with a fairly large community at least.

</comment><comment><USER15> This is really encouraging to hear, I run an Open Source community that is a fifth the size of Webpack. And in the back of my mind I'm trying to figure out how to help fund/pay/reward the community, without then making it awkward, political, or money driven.

How did you get the companies to sponsor? It seems like once you are above a certain threshold/community level, it makes sense for a company, but did you just reach out or was it people you already knew? Or people you bumped into while talking at a conference? But how do you know if they are the ones at a company that can sign off on sponsorship? This very much seems like "sales", how does an Open Source-loving engineer get good at sales?

</comment><comment><USER16> Maybe they could employ a programmer who knows how to turn unbelievably complex software into incredibly simple software that doesn't include constant relentless breaking changes.

<comment><USER17> How do you hire programmers like that?

<comment><USER18> <stereotype joke> By not hiring a JavaScript developer. </stereotype joke>

More seriously... I've just today finished updating some C++ code that integrates the Chromium Embedded Framework into Unreal Engine 4 to work with current versions of both CEF and UE4 and even building all this, Separate CEF sub process binaries without a strait forward make && make install, and debug builds of the entire unreal engine editor to track down CEF initialisation errors. Was simpler than React, Redux, WebPack, Babel, et.al. ... and I'm not a professional C++ dev using it every day either!

I'm also not going to blame the language either. I sat down and worked through the entire EmberJS documentation in a couple of afternoons worth of spare time. It was clear, concise and orderly. It was easy and now I'm even looking forward to EmberJS 3.0 with Glimmer and full support for building stand alone web components using just the EmberJS ecosystem. So clearly it's not some fundamental failure of my ability to learn/understand JavaScript.

So at the end of this joke/rant I guess I have to point my criticism at the subset of JavaScript developers who have allowed the crazy parts of the JavaScript ecosystem that they maintain, to get out of hand. I suspect because they never stop working with it and consequently are able to hang on to the rollercoaster and productively make use of it while being blind to outside criticism because as far as they can see it's all simple and logical and it's everyone else that doesn't understand it.

<comment> aaron-lebo It just sounds like you found a quality C++ library, there's thousands that are horrific messes. Compiling some of them is unbelievable amounts of frustration, which npm mostly avoids.

Webpack works fine and is easy to use, part of the issue is that people criticizing JS don't know what they are talking about because they don't actually use JS that much and they don't understand why that makes their criticism not that useful (not you, just in general).

JS has a magnitude more devs than some languages and a lot of them are new users, with that being the case, it isn't shocking that it makes for a large number of bad libraries. But if you know your tools, it's not that big of an issue.

<comment><USER19> Webpack is terrible to use. Very inconsistent and results in a mess of code for your configuration. I suppose part of that comes from the 10+ loader interfaces it uses under the hood. But most of it comes from organic growth (I assume) and the fact that there are no JavaScript standards (e.g. no filesystem or pipe like interfaces, the competing module systems and no standard library)

This is a nice guide to starting with webpack that I think describes it very well: [https://what-problem-does-it- solve.com/webpack/index.html](https://what-problem-does-it- solve.com/webpack/index.html) I'd recommend this guide to anyone who is trying to get started with webpack.

I wish there was an intuitive way to chain JavaScript file transformations together, but it doesn't seem like there is one yet. Webpack is close, but I think it has too much baggage to get there.

<comment><USER20> Webpack standardizes JS build process. It is a massive improvement from Grunt - plugin dumpster, Gulp spaghetti code and makefile - DIY everything.

Issues you might have are related to broken web frameworks (angular4) than webpack itself.

</comment></comment></comment></comment></comment></comment><comment><USER21> Thanks for making and continuing to improve WebPack. I use poi.js which uses WebPack internally for low/no config dev.

[https://poi.js.org/](https://poi.js.org/)

</comment><comment><USER22> Why is it so slow with that kind of funding?</comment>


Oracle Takes On Amazon With New Cloud Service - <AUTHOR> http://www.businessinsider.com/larry-ellison-just-took-on-amazon-with-a-new-cloud-service-2012-9?op=1

<comment><USER2> Larry Ellison 4 years ago: "What the hell is cloud computing?" <http://www.youtube.com/watch?v=0FacYAI6DY0>

</comment><comment><USER3> Good luck to them, Oracle has a major image problem to overcome before most people I know would be happy using them as a cloud provider.</comment>


Charlie Chaplin's Scandalous Life and Boundless Artistry - <AUTHOR> http://www.newyorker.com/culture/richard-brody/charlie-chaplins-scandalous-life-and-boundless-artistry <comment><USER2> I had the good fortune of reading his autobiography. I highly recommend it. It explains the events described in this article (eg the ostracization; allegations of being a communist; attacks on his character; the affairs; seizure of his wealth by the government and the fact that he had to stay away from the country that he loved and called his home for majority of his life). I truly walked away feeling deeply pained and felt sorry for him -- here was a man born into extreme poverty (the scene in one of his movies where the tramp eats a shoe due to extreme hunger, was a part of Chaplin's childhood). His mother went insane (became catatonic) due to hunger. As a small boy he saw his mother being taken away by the police and put into an asylum. And this person, spent his entire life making people laugh.

He was born to make us laugh. I think instead of focussing on his shortcomings and marriages, it is far more important to focus and discuss his craft.

The lookup Hanna speech [1] at the end of the great dictator is must read / listen. One of the best monologues in movie history. Tell me if this speech doesn't move you!

[1] [http://www.americanrhetoric.com/MovieSpeeches/moviespeechthe...](http://www.americanrhetoric.com/MovieSpeeches/moviespeechthegreatdictator.html) (added link)

<comment><USER3> That Hanna speech is amazingly moving. To add to the dramatic effect, watch it with the 'Time' track from Inception overlaid. You will get goosebumps:

[https://www.youtube.com/watch?v=NXsoakk3GRk](https://www.youtube.com/watch?v=NXsoakk3GRk)

<comment><USER4> Thanks for the link. I only new the speech from this mix, which while different in style, also gave me goosebumps: [https://www.youtube.com/watch?v=Oe5wW-g6FgU](https://www.youtube.com/watch?v=Oe5wW-g6FgU).

</comment></comment></comment><comment> guard-of-terra "In 1952, in the midst of McCarthy-era paranoia,.. his reëntry permit was revoked"

You know why? What tipped the scales is high profile British writer listing him (along with some other people) as potential communist in a secret list submitted to Intelligence.

You know who compiled that list? George Orwell.

<comment><USER5> Details: [https://en.wikipedia.org/wiki/Orwell%27s_list](https://en.wikipedia.org/wiki/Orwell%27s_list)

</comment></comment><comment><USER6> One thing I find interesting about Chaplin is that he also composed the music for his films.

[http://www.charliechaplin.com/en/biography/articles/205-Chap...](http://www.charliechaplin.com/en/biography/articles/205-Chaplin- as-a-composer)

</comment><comment><USER7> I was peeved to read about his lawless character with young women in the article. I only knew about his fourth wife, a famous New York socialite who left J.D Salinger for Chaplin, essentially. Oona O'Neill (yes, that O'Neill) was something like 18 or 19 when she married Chaplin, but they stayed married until he died over 30 years later.

The article makes it sound like he just raped his way across America, and perhaps he did -- I wouldn't know. It does note that he was accused of this by a Nazi sympathizer, but says that the accusations were essentially true.. About the man who made "The Great Dictator".

The journalist doesn't bother to mention that he did settle down for what was by most accounts a loving relationship, and must have been a successful marriage by any standard.

<comment><USER8> From what I understand, many of his early marriages were a result of affairs with young "starlets" which resulted in pregnancy and subsequent marriage to avoid legal issues or further career damage. Those early marriages didn't last since they were only based on necessity but when he married O'Neill, they actually made a stable couple.

It's interesting to read about as it's the sort of thing you see in so many other stories about "stars" sleeping with groupies or other admirers, often below the modern age of consent. I've wondered before how much of that has to do with the stereotypical entertainer's lifestyle or what it says about arrested development in performing artists.

<comment><USER7> Indeed. It seems to be historically common for people in power.

I'd propose that what's different in the last two hundred or so years is that the middle class exists, is large enough and is literate enough to impose its values on 'upper class' citizens, or at least has a large enough media platform to shame them.

In the west, Victorian middle class citizens really took up the idea that social improvement was tied to comportment. We see this kind of thinking all the time still, for instance, I just got an e-mail from Quora with the title "Why do billionaires dress so badly?"

Top answer: because they don't have anyone to impress.</comment></comment></comment>


The middle class is shrinking and in Chicago it's almost gone - <AUTHOR> https://www.wbez.org/shows/wbez-news/the-middle-class-is-shrinking-everywhere-in-chicago-its-almost-gone/e63cb407-5d1e-41b1-9124-a717d4fb1b0b <comment><USER2> We should be careful with maps like this of Chicago, since the time period we're talking about (1970-) coincides with the phasing out of redlining, which kept black families out of white stronghold neighborhoods. It could just be that what you're looking at is the gentrification of the north side and "white flight" into the suburbs.

Also, the numbers for this map don't sync up with the "rich blocks, poor blocks" census maps of Chicago. For instance, these maps appear to show Portage Park and Jefferson Park as low-income neighborhoods; that's not what the 2010 census map shows (substantially above the state median!), nor what anyone would expect if they were familiar with those neighborhoods, which are both middle class enclaves. In the 2010 census maps, as soon as Austin gives way to Belmont-Cragin, we're back into middle class neighborhoods on the west side.

This map also has Mt. Greenwood as a poor neighborhood. Unless we suddenly stopped paying cops and firefighters, that seems pretty unlikely. Someone else familiar with the city got an idea of what's going on here?

<comment><USER3> The linked blog post is better. Reading through the methodology it seems this is just white flight. At least without representing the full regional map that would be the easiest conclusion.

<comment><USER2> They also don't mention the closing of the US Steel plants in this article, even though for the time frame they're discussing it was probably the single most important event for the south side middle class.

</comment></comment></comment><comment><USER4> Hmm, following the link to look at more charts of the underlying data I'm confused about how to interpret this.

First, the definition of "middle class" they're using is literally average Chicago income, not fixed to some inflation adjusted amount or compared to the U. S. as a whole. I didn't see at a glance if that average income changed over the time. If the average income rose, but the distribution changed, that's not necessarily the middle class being "almost gone".

Also, there's a lot on uncontrolled confounders here. Age is a big one. It mentions that half of census regions saw their average income decline by 20% but that of those regions the majority of people there are under 19 (!).

So one interpretation of the data could be that the city as a whole got richer but a few small areas stopped having kids.

</comment><comment><USER5> If the modern day poor are living an equivalent life style to the middle class from 50 years ago is that really a problem? That's what part of this article seems to describe. Also would be interesting how much of this is attributable to the rise in prevalence of two income households. 2x a middle income would be considered wealthy by the measure used in this study

<comment><USER6> I don't understand where you're asserting the article says that. The fact that neighborhoods whose per capita income was around the middle in 1970 are in the lower quintiles now does not mean that the 1970 middle class and the 2017 lower class have "equivalent lifestyles." It means the neighborhoods are poorer.

<comment><USER3> They literally outline a house that has changed occupants (white/middle class to Latino/lower class) but the living/working situation was the same.

</comment></comment></comment><comment><USER7> How is the middle class in the US in general? This is completely anecdotal and based on random strangers on the internet, so it may be wrong, but Americans seem more careful with their money today than they did 15 years ago.

I buy a lot of board games, and I've noticed how discussions on $100 kickstarters have started being about how it could break someone's budget. I'm personally part of the Scandinavian middle class, and a hall mark of that, is that you can spend $100 on something silly and not worry about it.

It's extremely poor data of course, but it's something I just never saw 15 years ago.

<comment><USER8> Scandinavian middle class is not quite so uniform. Norweigian is considerably more wealthy than Swedish. I would guess Danish inbetween though closer to Swedish. I actually guess you are Norweigian!

<comment><USER7> Norwegians are in a league of their own, that's true, though it's more their society that had money and not private citizens as such. They generally also have rather high prices on everything.

I'm Danish though.

</comment></comment></comment><comment><USER9> > For UIC to consider a census tract middle income, the average per capita > income there had to fall between $28,712 and $43,068.

What a hilariously narrow definition of "middle class". That's roughly $14.35 to $21.53 per hour.

This entire analysis is a waste of time.

Is the underlying data available? I'd love to take a crack at producing some better visualizations.

<comment><USER10> I suspect they were using the data from here [1]. Quite well organized and easy to play with, even has numeric indexing of the various areas so you can mix and match the data easily!

[1] - [https://www.chicago.gov/city/en/depts/cdph/provdrs/health_da...](https://www.chicago.gov/city/en/depts/cdph/provdrs/health_data_and_reports/svcs/office_of_epidemiologydataanalysisrequests.html)

</comment></comment><comment><USER11> It's very obvious to me that the largest American cities are built for the very wealthy and the very poor. If you can afford to move out you can greatly increase your quality of life elsewhere.

<comment><USER12> In the 1970's crime spike in many American cities, and the 'burbs' became a real aspiration. The middle class simply moved out.

American cities have mostly 'business cores' anyhow, with big banking buildings, not like in Europe where they're pedestrian and have homes.

In some cities, there's been a renaissance of urban living and people moving back in since the 2000's, but it depends on the city.

My guess is that 80% of what's going on here is just that: demographic migration.

What we need is greater Chicago data and probably statewide as well.

I suspect you'll find the 'exaburbs' doing really well.

</comment></comment><comment><USER13> > A city census tract was considered "middle income" if its average per capita > income fell between 80 and 120 percent of the metro-wide average for that > year

The "middle class" term should be replaced in our language with something more concrete. It's not even a class after all. It's just an arbitrary label that doesn't have any useful meaning.

</comment><comment><USER14> In San Francisco, you actually have the new housing developments pay for the construction of Below Market Rate units. This makes new housing even more expensive and effectively prices out the middle class. The lower class can buy BMR units tho.

</comment><comment><USER15> Moreso, high income and low income have both decreased as well. Instead there's been large gains in "very high" income, and "very low" income. Other categories have essentially evaporated.

</comment><comment><USER16> Just did taxes. Middle class and bill went up significantly due to completely destroyed deductions limit.

Meanwhile people I know who make far less are getting great refunds and my rich friends don't notice anything different personally but their businesses are all saving money.

</comment><comment><USER17> I know the original article provides _some_ data in terms of what the "classes" are.

It would be nice to have some DEFINITIVE numbers that says what the class ranges are.

It seems like a moving target, and subject to wide interpretation.

What salary ranges constitute poverty? middle class? upper-middle class? upper class? insane 1%?

Is there even anything definitive to point to for these numbers?

</comment><comment><USER18> Chicago likely has harsh zoning laws that raise the cost of housing and also imposes steep taxes for not-great public services ([https://www.illinoispolicy.org/study-illinois-home-to- highes...](https://www.illinoispolicy.org/study-illinois-home-to-highest- overall-tax-burden-in-the-nation/)). Should it be any surprise that the middle class is moving to Phoenix, Austin, Dallas, Atlanta, and Florida?

Perhaps we ought to lower the cost of living ([https://www.econlib.org/yimby/](https://www.econlib.org/yimby/)) in Chicago, along with other cities like New York and Boston.

<comment><USER19> I agree that's likely true for New York and Boston (and San Francisco) but Chicago is actually fairly developer friendly and ok with density.

I think Chicago's taxation is the problem. The taxes are the highest in the nation and have scared off the middle class.

<comment><USER20> Not only are they the highest, they have to keep going up for the next few decades due to the structural debt of the city and the state.

<comment><USER21> _due to the structural debt of the city and the state._

That's a very soft way of saying "we have a super, mega, ridiculous pension crisis sucking the city dry"

</comment></comment></comment></comment><comment><USER22> They've transitioned into the Pension Class.

</comment><comment><USER10> There is one very key issue here that is often overlooked. Here are two datums. The first [1] is Chicago community areas by per capita income. The second [2] is the same areas by fertility rate. There is an _extremely_ strong correlation between these two datums. This holds everywhere from our world at large, to individual countries, to even community areas within an arbitrary city in the US. The areas with the lowest fertility rate is "Loop" with a fertility rate of 24.3 and a per capita income of $65,526. The area with the highest fertility rate is South Lawndale with a fertility rate of 99.6, more than 400% that of Loop. And they have a per capita income of $10,402.

While there may be some exceptions, they are indeed the exception. This holds true everywhere. These [3] are data for the US as a whole contrasting fertility vs income. Once again those earning less than $10,000 have a fertility rate more than 20 points higher (150%) the rate of those earning $200k+ per year. And there is a disconcertingly smooth gradient in between. As an aside there are also strong links between fertility and low education and high religiosity as well as low income.

Think about what this means for each generation of children. An ever larger portion of children end up coming from these families with low income, low education, and high religiosity. And now this even larger portion of society will go on to spread their genes in a comparable way meaning you'll see an _even higher_ chunk of children from the next generation coming from these groups. Poverty gets turned into a virus. Bringing people out of poverty might be a solution if not for the fact that then when people emerge from poverty, they stop having as many children.

And another issue here is that fertility rate understates the issue! When one group has the same number of children but has them younger, this has a direct effect on 'real' fertility rates. Imagine there are two groups with an identical fertility rate. However, one has children at 15 years of age on average, and another on 30 (using these numbers only for convenient math). By the time the 30 group has had their child the 15 group has had a child, and that child is now also having a child! You have the exact same fertility rate on paper, but in terms of population impact the young group has a 100% greater fertility rate.

Ultimately people who can in no way expect to be able to provide even a half decent upbringing for children need to stop having so many children. At the same time people who actually can afford to help provide a great life for a new generation need to stop being so self centered and do just that. Until that happens what do people expect to see? You're going to see poverty spreading rapidly _even if_ it was holding completely level simply because you'll see more new people in poor families.

Keep in mind the twisted nature of exponential growth. If you have a population of 10,000,000,000 with a fertility rate of 2 and then a population of 10 with a fertility rate of 4, that population of 10 will become the majority and in the longrun approach becoming 100% of the population. You cannot overstate the relevance of fertility rates if you at all care about socioeconomic issues.

[1] - [https://data.cityofchicago.org/Health-Human- Services/Census-...](https://data.cityofchicago.org/Health-Human- Services/Census-Data-Selected-socioeconomic-indicators-in-C/kn9c-c2s2/data)

[2] - [https://data.cityofchicago.org/Health-Human- Services/Public-...](https://data.cityofchicago.org/Health-Human- Services/Public-Health-Statistics-General-fertility-rates-i/g5zk-9ycw/data)

[3] - [https://www.statista.com/statistics/241530/birth-rate-by- fam...](https://www.statista.com/statistics/241530/birth-rate-by-family- income-in-the-us/)

<comment><USER23> I feel like this has been the case for a long time, though, maybe forever. I recall the stereotype of the Irish Catholic family, for one.

</comment></comment><comment><USER24> What's everyone's opinion of Andrew Yang?

</comment><comment><USER25> Is this not the goal? Everyone seems to want this. Reduced taxes for the rich. Deregulation. A better "business environment" due to "small government". The continuation of employer-provided healthcare. Stricter intelectual property laws. Ever single domestic policy choice of late seems determined to do this. Middle america should be happy. They keep voting for this stuff.

<comment><USER26> Chicago has been overwhelmingly governed by the Democrats, yet they things you've listed are usually pushed by the Republicans. And people leaving are usually going to the majority Republican states and cities. How can you explain this phenomenon?

<comment><USER25> Chicago's problems are caused by things well beyond chicago. These local issues are driven by national choices. Elect all the best mayors you can, but America's economy is dominated by the national government, and to a lesser extent states. Chicago's problems will be solved when the nation breaks free of the ussual squabbles and opts to resolve social issues rather than scream dogma at each other.

<comment><USER20> Chicago, and Illinois, has made its own problems far worse than other cities and states by a completely corrupting their defined benefit pension system. Also see NJ/CT/KY. They have hundreds of billions in debt coming due, the figures are staggering. It also doesn't help that the weather in Chicago is not to most people's liking, so other than employment or existing family, most people aren't going to choose to move to Chicago.

When Warren Buffet says he's avoiding doing business for the next few decades in certain regions due to the defined benefit pension debt, I would certainly be making sure I have backup options or a way out.

<comment> grayed-down I'm not questioning or disbelieving the veracity of your statement, but do you know where Buffett made those comments? I'm not seeing anything in a casual search and that would be interesting to parrot around.

<comment><USER20> I think it was in one of his letters from a couple years ago too, but he most recently said it a week or two ago:

[https://www.cnbc.com/2019/02/25/full-transcript- billionaire-...](https://www.cnbc.com/2019/02/25/full-transcript-billionaire- investor-warren-buffett-speaks-with-cnbcs-becky-quick-on-squawk-box- today.html)

> if I were relocating into some state that had a huge unfunded pension plan > I'm walking into liabilities. 'Cause I mean, who knows whether they're gonna > get it from the corporate income tax or my employees-- you know, with > personal income taxes or what. But that-- that liability isn't gonna-- you > can't ship it offshore or anything like that. And those are big numbers, > really big numbers. And they may come--you can delay a long time. I mean, > they-- you're getting pushed maybe somewhat. But the politicians are the > ones that really haven't attacked it in a good many states. And when you see > what they would have to do-- I say to myself, "Why do I wanna build a plant > there that has to sit there for 30 or 40 years?" 'Cause I'll be here for the > life of the pension-- plan-- and they will come after corporations, they'll > come after individuals. They-- just-- they're gonna have to raise a lotta > money.

<comment> grayed-down Thanks for that! And I hate to say this, but Buffett is almost damnable for saying this because of the party and candidates he almost exclusively supports.</comment></comment></comment></comment></comment></comment></comment>


What'd Make a Better Rocket, Nuclear or Ion Engines? - <AUTHOR> http://www.wired.com/2015/10/whatd-make-better-rocket-nuclear-ion-engines/?mbid=social_twitter <comment><USER2> This is a pretty dumb article.

Note there are other kinds of "nuclear engines", including one where you use a nuclear reactor to power an ion drive.</comment>


Should you go to graduate school in a recession? - <AUTHOR> http://www.marginalrevolution.com/marginalrevolution/2009/03/should-you-go-to-graduate-school-in-a-recession.html <comment><USER3> Link to the original article being summarized and discussed in this blog post:

[http://blog.penelopetrunk.com/2009/02/03/dont-try-to- dodge-t...](http://blog.penelopetrunk.com/2009/02/03/dont-try-to-dodge-the- recession-with-grad-school/#more-2071)

And the overall bullet points:

 _1\. Grad school pointlessly delays adulthood.

2\. PhD programs are pyramid schemes

3\. Business school is not going to help 90% of the people who go.

4\. Law school is a factory for depressives.

5\. The medical school model assumes that health care spending is not a mess.

6\. Going to grad school is like going into the military.

7\. Most jobs are better than they seem: You can learn from any job._

<comment><USER4> I know you are just summarizing (thanks) so don't take this as a response to you - but I strongly disagree with a couple of the points the author makes (I don't feel I can reply to the ones that don't apply to me).

>1\. Grad school pointlessly delays adulthood.

Maybe it delays adulthood a bit, in some respect, but I certainly wouldn't call it pointless. I've learned a huge amount in the last six months (which is how long I've been a grad student).

>6\. Going to grad school is like going into the military.

The justification for this: _Applications to the military increase in a bad economy in a disturbingly similar way that applications to graduate school do. For the most part, both alternatives are bad. They limit your future in ways you can't even imagine, and they are not likely to open the kind of doors you really want. Military is the terrible escape hatch for poor kids, and grad school is the terrible escape hatch for rich kids._

That's a _horrible_ argument. Just because more people go to the army at the same time more people go to grad school doesn't mean the experience is at all similar (for one, I'm pretty sure most soldiers get more sleep than I do). I was going to say that I can't imagine how a master's could limit my future, but that would actually be consistent with the author's claim, so I'll instead say that without justification I don't accept that a master's will limit my future. And the whole rich kids/poor kids thing at the end is just...I mean...I don't know many rich grad students, I'll put it that way.

<comment><USER3> No offense taken and upvoted.

I think the article oversimplifies things to a degree, so it's also a reflection of the author's viewpoint and in that sense almost comes across as rationalization. But that doesn't mean the points aren't correct - I had a unique job right out of college that gave me a lot of firsthand experience with a top notch phd program and allowed me to witness the grad student lifestyle w/o having to go myself. I was a web developer for the biology department of my college and worked out of a research building, separate from all the other admin staff, which was great because I got to hang out with people my own age, all the grad students (and even some of the younger associate profs) near my office. And seeing them go through the phd program definitely gave me the strong impression that the ones that survived (at least in a mentally stable way) were the ones that loved research and academia, or at least could make themselves love it over long periods of time.

It's not to say you're locked into academia as a career if you get a phd - <USER2> of my good friends went on to join a bio startup, there's a lot of those in San Diego - it's just that it's the default path and most of the above bullet points are still true, especially the pyramid scheme part. They're basically slave labor for whichever prof heads up their lab.

It's worth noting that you can and should apply #7 - _Most jobs are better than they seem: You can learn from any job_ \- to grad school as well and treat it as a job with a long term contract, one that you need to mine for all kinds of interesting things that you didn't think you'd learn. For example, I bet a lot of people (understandably) go into a top neuroscience or cell biology program thinking they'll learn a lot about biology and research, and they do, but the ones that did really well learned things like how to manage your time well, motivate yourself on an independent schedule, network in a loose non-corporate environment and blow off steam with non-contact sports.

<comment><USER4> >It's worth noting that you can and should apply #7 - Most jobs are better than they seem: You can learn from any job - to grad school as well and treat it as a job with a long term contract, one that you need to mine for all kinds of interesting things that you didn't think you'd learn. For example, I bet a lot of people (understandably) go into a top neuroscience or cell biology program thinking they'll learn a lot about biology and research, and they do, but the ones that did really well learned things like how to manage your time well, motivate yourself on an independent schedule, network in a loose non- corporate environment and blow off steam with non-contact sports.

Very good point. I'm learning a lot about CS, but I'm also learning my limits in terms of how much work I can do in general, and how to handle being overwhelmed. I'm making excellent contacts. I'm learning to organize myself better (and actually use a calendar). Even without the CS, I will leave grad school better prepared for the workplace than I came in.

</comment></comment></comment></comment><comment><USER5> I know this is likely to be viewed as off-topic or whatever, but... there are some really cute girls in grad school, especially the European ones. And they are past that whole annoying where's-the-party phase. You also get to learn a lot about a topic, from professors who think you have a brain and are worthy of conversation. So, I have to say, there are some wonderful intangible benefits to grad school. If I didn't travel randomly, I would totally enroll in a graduate studies program, merely for the enjoyable social/intellectual aspects. Some of you who are young and have cash-flow-positive startups should seriously consider it.

Not everything has to be computed in dollars/euros. Remember, there is a human aspect to your life that cannot be bought. You can't spend $15m to be 24 again, even if we DO find a way to live forever.

</comment><comment><USER6> It says a lot more about the author's bias than anything about grad school in general.

In the median case, grad school is probably a waste, certainly most PhD's in the humanities are. But with a PhD in economics you can get a job working for all of those interesting sounding NGOs that advertise in the back of The Economist. An MD or PhD in biochemistry/subset is required to do serious medical research.

An MBA from a top tier business school (the more technical the better, personally I'd rather get an MBA from MIT than Penn) dramatically increases salary compared to people without an MBA. Could you have done better laddering up in the corporate world? Maybe, but it's a lot riskier, and the author forgets that pointlessly delaying adulthood is fun! Perhaps the author has forgotten that.

A professional graduate degree also provides you with a risk-free way of transitioning careers. Did you do an undergrad in business? Do you want to program now? Get a master's degree in software engineering.

And the comparison to joining the military is just insulting.

<comment><USER7> "grad school is probably a waste, certainly most PhD's in the humanities are."

This rests on the assumption that learning is only valuable insofar as it helps the learner attain greater financial reward. You may define knowledge as a commodity which has value defined by national monetary systems, but those who pursue PhDs in the humanities wager the knowledge they gain in their pursuit of the degree has value in relation to their context greater than the value reflected in its commodification.

<comment><USER4> Meh. If I understand you correctly, you're saying that a humanities PhD might not have practical value, but it has value to some people because they like it and come out of it more worldly. I mean, sure, okay, but there is a qualitatively different type of advantage that comes with a technical PhD.

<comment><USER7> I don't disagree with you on any particular point. I was only stating that to dismiss a PhD in the humanities "as a waste" says a lot more about the position from which one makes that dismissal than about the humanities PhD itself.

</comment></comment></comment></comment><comment><USER8> My biggest counter to this is the reason I went to grad school (MBA - done on an evening program)

After a layoff is a great time to reassess what you are doing in your career. My wife is an associate attorney, many of whom are getting laid off right now. If she got laid off she's not sure she'd go back in to law. I was an engineer who wasn't sure I wanted to write code for the rest of my life so I got an MBA.

Grad school is a great way to get a "second" chance at what you want to do, particularly if you've spent a couple of years working and found that the reality of your career doesn't match the vision you had in college.

In fact, regardless of being laid off, I'd recommend taking a couple of years off between undergrad and grad school working before starting a graduate program.

</comment><comment><USER9> I can see the merit to the argument that one shouldn't pursue grad school, but just as a counter balance, I thought I'd list some advantages:

1\. You can often earn a higher starting salary when finished (assuming of course that the recession has passed by the time you're finished)

2\. Access to educational loans and grants

3\. Access to school resources (e.g. library, equipment, other students, mentors, etc.). Just last week I downloaded about $50,000 of market research through my school's subscription to eMarketer, Gartner, Factiva, etc.

4\. Access to student pricing on software and hardware (e.g. MSDNAA, Adobe, Apple discounts)

5\. Access to student camps competitions

6\. Better access to internships

Now, am I doing grad school? Nope. It didn't really seem to make any sense for what I wanted to do for a career. But, I do see some merit.

</comment><comment><USER10> Why is the bashing of the military in this conversation accepted without a second thought? The armed forces have had a rough time of it the last few years, but many servicepeople find the military incredibly rewarding. There's a reason why those retired guys wear military caps that they earned when they were 25.

<comment><USER11> American engagement in recent conflicts has been enormously unpopular. There is a sense that the Armed Forces no longer serve to protect and defend America, her peoples and her ideals, but the political and economic aspirations of a very few.

If trust in the government and its goals can be restored, then a belief that the Armed Forces are an honorable and worthwhile avenue of service will also be restored.

</comment></comment><comment><USER12> Like all of the previous discussions about school/no school, it really depends on the person or the field. Some people need the structure of a university environment to learn and some jobs require a specific degree. Other people and other jobs just don't.

As far as the recessions goes, in the sciences and engineering, I would be slightly concerned about funding for students, even once you get admitted. Even before the current recession I knew too many grad students who had to TA or switch groups, etc. due to funding problems. Not something I would have imagined before I spent time in grad school.

<comment><USER13> Weird, surely you noticed the TAs during undergrad? Did you think they were grading papers for fun? =P

<comment><USER12> I meant students having to revert to TAing after losing research funding. Generally only the first year grad students would TA classes and then join a research group and get paid as a research assistant.

I, along with most of the others I knew in science/engineering grad school, didn't really think that funding would ever be an issue, but I saw far to many cases in which it was.

<comment><USER14> Yeah, I'm in an undergraduate engineering program and I've always assumed that funding wouldn't be a problem.

I was under the impression that schools didn't want to accept someone who was going to drop out because of finances.

So basically if they thought you would not be able to pay, you wouldn't get in.

That said, I knew that funding would probably include things TAing, and that RA's were usually one of the better sources.

NSF said that from 93-96, only half of newly minted engineering phds graduated with debt, so the percent is a little higher than I thought.

NSF 96 debt info: <http://www.nsf.gov/statistics/issuebrf/sib98318.htm>

</comment></comment></comment></comment><comment><USER15> I agree with the author that many people go into graduate school for the wrong reasons. However, it doesn't follow that all graduate school is bad.

The key here is the distinction between practical and impractical knowledge. The author seems to operate under the assumption that only practical knowledge is good. In her experience, she has been able to gain practical knowledge at least as efficiently outside of the graduate educational system. I agree with her point here, but I don't think you can discount the value of impractical knowledge - which I would define as knowledge that does not have any immediate real world application.

The value in impractical knowledge is twofold: 1) it can (and often is) able to called on later and 2) it can serve as an introduction to other practical knowledge. For instance, even the lawyer that the author has argued has wasted his/her education by transferring to a different career field may immeasurably benefit from some theoretical aspect of his graduate experience. More likely, an experience in graduate school may introduce a person to a subject area or conceptual idea that has a practical application they would never have been exposed to outside of that environment.

Some may argue that both of the above benefits can also be obtained through real world work experience, which leads to the question of knowledge for its own sake. I personally am a believer in learning for learnings sake, although I'm not sure I can articulate that argument in a comment length...

</comment><comment><USER16> I suspect that 99+% of people who pursue a PhD will end up disappointed and bitter.

Your chances of success are probably better with startups.

Also, keep in mind that the vast majority of research done in CS is about improved implementation -- not new applications. The main exception here is HCI + MIT Media Lab, which are more open to new apps.

Of course, if you do get accepted into a top 4 university in the US, then you might want to think about it. That's an impressive accomplishment, especially for international students.

</comment><comment><USER17> It is interesting to think of this post in relation to the one regarding scalable vs. non-scalable careers. Professional schools are prerequisites for many of the most obvious, lucrative non-scalable careers. But if you consider the possibility that you will change careers even if you make it through graduate school (because you get tired of being a dentist, for example), then your decision to pursue a non-scalable career looks much riskier.

</comment><comment><USER18> <http://news.ycombinator.com/item?id=501428></comment>


Why Windows Software Could Use a Rush of Fresh Air - <AUTHOR> http://www.nytimes.com/2008/06/29/technology/29digi.html?_r=1&adxnnl=1&oref=slogin&adxnnlx=1214755295-Axr36TjsXVPhTiByES3zvw <comment><USER2> The best solution is ... starting over? Really?

Because Microsoft actually did that at least once, and this writer apparently missed it. They called it Windows NT. Windows Vista isn't version 12, it's NT 6.0. (Open a command prompt and see.) Which is why the next version is called Windows 7.

The author actually suggests that MS should write a new OS and run old code on some sort of VM or compatibility layer, apparently entirely unaware that every modern Windows PC already does pretty much exactly that.

Love it or hate it, Microsoft's devotion to backward compatibility is a big part of what got it where it is now. There are upsides and downsides to everything.

I don't even like Microsoft. But the insanity that gets hurled its way is ridiculous.

</comment><comment><USER3> Just to play Devil's Advocate here, I think the article has some serious flaws while making some great, fundamental points.

The biggest flaw? Stealing an underdog's strategy when you're not the underdog just doesn't make sense. Mac had almost no enterprise (outside of a few verticals) deployments when they decided to scrap it all and go for broke. Their customers were used to having to upgrade software (think Adobe, sound editing programs, Quark) every few years anyways, and they had those companies buy-in for the upgrade.

Contrast that to Windows where if they did, as the author suggests, start over from scratch, that would provide a HUGE opening to Mac and Linux. They would essentially be giving up their dominant market advantage. And for what?

Have they been hurting some? Sure. Vista's reception, while not a total disaster, has been lackluster at best, but their growth in other areas (home consoles, media centers) is strong, and their enterprise play is still a near strangle-hold (sure, you got a few oddballs running Mac, but very few enterprise grade deployments, where the real money in licensing and support is).

Why would they give all that up to copy-cat (and probably a poorer copy cat) their competitors' strategies?

</comment><comment><USER4> Is it possible that after the incredible disasters that windows 7 will be, Microsoft engineers a new OS with an UNIX kernel and a proprietary layer on top of it? Just a thought.</comment>


25 Startup Commandments: "You have to be wrong in the head to start a company" - <AUTHOR> http://ipcarrier.blogspot.com/2007/07/25-startup-commandments-great-stuff.html <comment><USER2> Originals:

<http://www.startupping.com/forums/showthread.php?t=347>

<http://news.ycombinator.com/item?id=24345></comment>


How to Be Startup CEO - <AUTHOR> http://startupguide.com/entrepreneurship/startup-ceo/

<comment><USER2> I think very highly of Ryan, and I think this is a great article full of good advice. On a related note, his book _Zero To One Million_ [1] is also excellent.

That said, Ryan presents one _possible_ model in this post, for how to structure and sequence things. I'm believe there are very probably other equally acceptable models, and maybe even some that are better (depending on the circumstances).

In our own case at Fogbeam, we are much further along on the "build your product" dimension, but haven't assembled an advisory board (although we do _have_ advisors and people that we'll probably invite to join our advisory board eventually. So I guess what I really mean is that we don't have a _formal_ advisory board) nor have we done anything about "find a place to work" unless you count "work from our respective homes and the occasional visit to Starbucks, Barnes & Noble, or Panera Bread". Certainly we don't feel the need to rent office space or anything yet.

OTOH, I can't endorse the bit about "keeping expenses to a minimum" enough. I know I keep quoting this, but I am heavily inspired by pg's "How Not To Die" essay[2] and believe in the idea of keeping expenses down to where you have a runway that is - essentially - infinite. Of course, the runway may be infinite but the "window of opportunity" may not be, and you have to be making forward progress somehow. But if you can find a way to move forward without spending much money, I say go that route.

FWIW, to illustrate with an example, here's how much we spend at Fogbeam:

salary: $0 - both co-founders are working for equity only (we both work day jobs to pay the bills)

development costs: $0 - both co-founders are developers, so we write code ourselves

rent: $0 - see above. We work from our homes and/or public locations, or the local hackerspace, etc.

Github: ~$50.00 / month, IIRC. We have a low-end paid Github account for our few private repos (most of our repos are public though, since we're an Open Source company!)

Hosting: ~120.00 / month. We maintain a couple of VPS's at Rackspace for miscellaneous services. We host our website, a SugarCRM instance, Bugzilla, a Mediawiki instance, FUCIT - our "competitive intelligence" tool - and one or two other things.

Hoovers: $89.00 / month - We had been using Hoovers for free through NCLive, but I just signed us up for a paid account so we can use some features we couldn't get from the free version.

LinkedIn: ?? I don't remember, but I maintain the low-end paid LI account. Let's call it $50.00 / month, I don't think it's much more than that, if any.

So basically, it costs us $300 / month right now, plus infrequent expenses like copying and printing, domain name renewal, and renewing our company registration with the Secretary of State. And I can keep paying $300.00 / month out of pocket essentially indefinitely, as long as I have a dayjob.

Now starting this summer, as we get more aggressive about trying to land our first few paying customers, costs will go up some. I just paid about $150.00 for a list of contacts from Hoovers (above and beyond the monthly subscription) and on-site meetings with customers will entail some travel expenses. But that's exactly why we're focusing on customers in North Carolina to start, so that we don't incur large travel costs jet-setting around the world. Realistically, we aren't trying to do business with companies in Abu Dhabi, or South Africa, or England, or probably anywhere outside the continental USA. And we're really more interested in sticking to NC, and maybe VA, SC, TN, GA, etc. for the short-term future. Again, keep costs and overhead low, until we can demonstrate some traction, then we can start looking at what happens next (do we try to raise venture money, etc.)

[1]: [http://www.amazon.com/Zero-One-Million-Built- Company/dp/0071...](http://www.amazon.com/Zero-One-Million-Built- Company/dp/0071496661)

[2]: <http://www.paulgraham.com/die.html>

<comment><USER3> The pricing for small teams with many repos is free at bitbucket...

</comment></comment><comment><USER4> _Growing up, I didn't really know much about entrepreneurship and business, but as I began working in companies around the age of 16 and 17, and started my company, iContact, at 18, I discovered that there's an entirely different world out there. In fact, there's a world of prosperity and unlimited wealth out there for you to reach for. You can enter this world. But first, you have to be aware that it exists and you have to work hard to create value for others._

This kind of struck a chord with me. I've grown up in a relatively "unprivileged" (lower-middle class) family, and I think one of the main ideas I'm struggling to grasp as I build my business is that if I work hard to provide something people want, then I'm entitled to wealth in return.

Having lived a life where all I know is that everyone in my family has nearly always had financial difficulties, almost as if we're all undeserving of wealth for some unknown reason, it's hard for me to get into a mindset where I'm able to ask clients/customers for large amounts of money, amounts that might not even put a dent in most people's wallets.

I'm actually just realizing now that if I want to succeed, I'm going to have to break through this mental barrier.

</comment><comment><USER5> In the past I thought about CEO like about a big boss of some plant etc. Lee Iacocca, Akio Morita.

Good old days...

I only can keep in mind movie "Other People's Money".

> The entrepreneur of post-industrial America, playing God with other people's > money. The robber barons of old at least left something tangible in their > wake- a coal mine, a railroad, banks. This man leaves nothing. He creates > nothing. He builds nothing. He runs nothing. And in his wake lies nothing > but a blizzard of paper to cover the pain. Oh, if he said, "I know how to > run your business better than you," that would be something worth talking > about. But he's not saying that.

</comment><comment><USER6> There's some bad advice in here, IMO, although overall it's decent.

Fundamentally I think there isn't much value in laying out every detail of running a company from zero to scale, since initially all that matters is doing as few things as possible and not even thinking about what kind of org chart or employee handbook you'll need later. A huge document like this kind of deters people at best, or at worst convinces them to worry about the wrong things at the wrong time.

I don't really feel like going through every single point, but e.g. the advice to do non-standard vesting is bad (4/1 is standard, and even if you think 6/3mo is better, it is worse by virtue of being non-standard), and the "advisory thing" is really not something you need at all. There's a lot of focus in the early part on stuff which is non-productive. (I stopped reading before the later stage).

A lot of advice needs to be highly specific to time and place. Someone starting a business in a place where most potential hires are familiar with startups is entirely different from doing so elsewhere.

<comment><AUTHOR> One of the things I appreciate about Ryan and the information he shares is that he provides very detailed information and a lot of it. He leaves it to the reader to determine what parts are helpful, which varies by what stage each company is at to your point.

However, I'd rather have too much information and be able to determine what is helpful myself at that point in time than to have someone choose to provide less information.

<comment><USER7> That's great for you. But what about the new CEO with no experience? Lots in here to lead them down the wrong path.

<comment><USER8> Possibly, but that same inexperienced CEO could find misleading information elsewhere. Instead of limiting access, let them judge for themselves.

</comment></comment></comment></comment><comment><USER9> Hey Watershawl... the thinking is that it may take 6 months to build a product that customers are willing to pay for. Definitely try to validate faster if you can!

<comment><USER5> In the normal economy the first year You take care about the business, the second year You and Your business take care about each other and the third year the business takes care about you.

So stay tuned.

</comment></comment><comment><USER10> 7% for the first hire was too much? It's a nice post, but if the first hire is as key as the text says, I don't think 5% is too much.

</comment><comment><USER11> > Figure out how to convince people to work for you for next to nothing (in > exchange for equity and deferred salary).

This is listed under how to avoid funding, but it's really just borrowing from other founders, without the promise to repay.

Assuming I make $80/year as a developer, a few co-founders like me are covering the $250k mentioned.

</comment><comment><USER12> The one thing I've learned from top entrepreneur is that there is no blueprint for success. What worked for Ryan in one company between 2003-2008 doesn't have to work in different time place. The only thing is to run it and improve it all along.

</comment><comment><USER13> According to the chart they'd have you make your first sale in Q3. Why would you wait that long to validate your business model? Incorporating and setting up a location should be one farther down the list.

<comment><USER14> He's does say that you should build your Initial Product or Service Offering right at the beginning. I think 'start selling' is more like a 1.0, out-of- beta, ready for the pragmatists in the adoption-curve mindset.

</comment></comment><comment><USER15> while I like the idea, my quick scan suggests there are two small holes. the quote ""examples are not another way to teach, they are the only way to teach" sums up the first. the second is learn by doing. practical excercses, learn by doing. the practical is a corner stone of good teaching. just my thoughts, hope you find them useful.

</comment><comment><USER16> This might be a good guideline for someone who has never had CEO experience (and one day aspires to be a CEO), but I think it's almost offensive for one person to try to write the definitive guide to be a CEO from 0-x employees unless you're the CEO of some Fortune 500 company.

<comment><USER2> I don't know if you know this or not, and I didn't notice if TFA made this point explicit or not, iContact was successful enough to be acquired for $169MM, and he remained CEO right up to the acquisition. And they grew to > 300 employees at their peak, so it's not like this guy is talking out of his arse here.

<comment><USER16> I never said iContact was a small company by any means. However, there are a many factors that can lead to a company growing >300 and getting acquired for that price. It might sound condescending so I understand the downvotes...but some of the things laid out in the post just sounded wrong to me.

<comment><USER2> FWIW, I did not downvote you.

That said, if there are things in the article you disagree with, why not spell them out and offer your alternative take, instead of just saying "it's offensive for one person to ..."

Disagreeing with an article and having a well reasoned position on why you disagree should be fine. But generic negative comments without much "meat" to them don't seem as valuable.</comment></comment></comment></comment>


I'm concerned with the move that FreeCodeCamp just pulled by leaving Medium - <AUTHOR> https://dev.to/ben/i-m-concerned-with-the-move-that-freecodecamp-just-pulled-by-leaving-medium-io8 <comment><USER2> On an unrelated note, I really wish that Medium hadn't gone to a pay-after- three model like everyone else- not only can I not afford it, it feels counter-intuitive. To me, Medium is a place where budding bloggers, industry professionals, etc. can get a start or work on building up and out their careers _and influence_ \- and it doesn't make sense to say "you have to spend money to give these people attention", especially when I can that same blog post somewhere else. Medium, the company, doesn't seem to produce much content, and so it seems unfair for them to restrict the flow to the creators themselves.

<comment><USER3> Budding bloggers can just stay outside the pay wall, which applies only to articles that the author chooses to monetize.

<comment><USER4> Incorrect if you don't publish your articles behind the paywall it will be distributed much less widely

<comment><USER3> I've not heard this before, and it doesn't match my experience. Is it an official Medium policy?

</comment></comment></comment></comment><comment><USER5> One thing mentioned in Ben's post that's worth talking about explicitly: if you add a post to Medium using their import feature, Medium will set the canonical URL to your original URL. This meant that when if you imported a post from your personal blog and submitted it to FreeCodeCamp, you'd get a big SEO benefit: your post was shared on one of the biggest Medium publications, but any backlinks and ranking boosts would apply back to your original post, on your website.

As part of this migration, FreeCodeCamp has removed canonical URLs from submitted posts - your original post is now competing with freecodecamp.org, and Google (and other search engines) is going to do a duplicate content check. Considering that FCC is in the top 2000 sites in the world according to Alexa[1], there's a _strong_ chance your site will be penalized. This is a big deal for authors.

[1]: [https://www.alexa.com/siteinfo/freecodecamp.org](https://www.alexa.com/siteinfo/freecodecamp.org)

</comment><comment><USER6> I understand his concerns, but frankly Medium is a purulent ulcer on the web that needs to be put out of its misery ASAP.

</comment><comment><USER7> Please post here if you file a DMCA claim against them for misuse of your content without your permission. Their contact information is in their terms of service (firstname.lastname@example.com) and their public non-profit filing (1), and they declare themselves subject to US Law.

They are a nonprofit, so they have the option of offering each author a tax deduction as payment for content. If you have entered into any rights deal with them directly, you may not have standing to make a DMCA claim; take care not to knowingly do so under such circumstances, as that is likely a crime under US federal law.

Their hosting provider will likely also want to be notified of your DMCA claim, as they may be in violation of contractual agreements signed for their hosting.

(1) [https://s3.amazonaws.com/freecodecamp/Free+Code+Camp+Inc+IRS...](https://s3.amazonaws.com/freecodecamp/Free+Code+Camp+Inc+IRS+Determination+Letter.pdf)

</comment><comment><USER8> What kind of example does it set for FreeCodeCamp to rely on a site like Medium as opposed to making its own site and sharing that code on GitHub? Budding engineers don't need to rely on sites like Medium when they can put together their own sites and learn about SEO.

<comment><USER9> That's a really good point, but that may not be ideal from a pure learning perspective.

Engineers are often subject to the whims of management, tight deadlines, dependency quirks, their own personal bias, and so on. A living example would showcase all of those things, but unless you annotate each line and comment excessively, you lose a lot of context.

It's also much easier to follow a tutorial than to dig through commit history and piece everything together yourself.

</comment></comment><comment><USER10> The intricacies and legal details here are a little beyond the scope of my understanding. Medium was never much, and when they turned into a popup- serving nagware, that was the end of them for me.

</comment><comment><USER11> I thought we had a story a while back about FreeCodeCamp trying to contact the authors while trying to get off Medium.

In the end it seems very strange that Medium, FreeCodeCamp and the authors all were intertwined in very strange ways as far as ownership and why they were involved together.

</comment><comment><USER12> I am happy with the FreeCodeCamp move and I want all the engineering blog to move off from the medium.

It's really pain when you open the blog and you get they paywall to say "You read much ...". Really, It's annoying what Medium become.

</comment><comment><USER13> Does medium even provide any valuable content? Every time I've been there's it's been nothing but people who are total amateurs talking out of their ass as tho they're experts.

<comment><USER14> There's also seemingly useful articles that end up being content marketing!

</comment></comment><comment><USER15> "Publications on Medium are bound by the Medium Terms of Service, and they have no right to your content that you do not explicitly grant them. That includes exporting, copying, or reposting your content to any website that is not Medium.com"

"You own the rights to the content you create and post on Medium"

Wait what? If it's my content and I own the rights, I can repost it wherever I wish.

<comment><USER16> Yes, _you_ can post it wherever you wish. A third party publication on Medium, however, cannot do so without your consent.

<comment><USER17> It might help to explain the Medium third party publication system, as it wouldn't exactly be clear to people who haven't experienced it before.</comment></comment></comment>


BelKor has allegedly won Netflix Prize despite being second on the leaderboard - <AUTHOR> http://www.netflixprize.com/community/viewtopic.php?pid=9237#p9237

<comment><USER2> an .0001 difference would seem to me to be 'too close to call' and a reason to reopen and let both teams work for another 30 days to get to a larger than .1 difference.

Just like in ping-pong, extend the game if it is that close until there is a clear winner.

With a winner takes all contest like this there has to be a clear winner.

<comment><USER3> Winner takes all contests seem to be zero sum games to me, in a certain sense. The pie is a fixed size, and one guy gets all of it. I think I'd rather sink my time into business or open source stuff.

<comment><USER4> Saying a winner-takes-all contest is "zero sum" in any sense is utterly nonsensical, as it's clearly not zero sum since one group wins $1,000,000.

Also, "one guy" doesn't necessarily get all of it, as team co-operation is implicitly encouraged as it increases the chances of winning. Additionally, the game is strictly skill-based, so the more skilled you are the more likely you are to win, which may encourage you to work in the contest. And that's excluding all the additional externalities involved.

<comment><USER5> > Saying a winner-takes-all contest is "zero sum" in any sense is utterly > nonsensical

I thought that zero sum just meant that the total score of all players is a constant, regardless of the strategies chosen?

</comment></comment></comment></comment><comment><USER6> A contest like this one (with such a large prize at stake) should have seen this coming and instituted a different rule for their deadline. Something like "24 hours after the last submission." Therefore you wouldn't have someone sniping the win like it seems has happened.

<comment><USER7> But this isn't an auction. You can't just conjure up a better result once you know you've been surpassed. Belkor etc was probably working just as hard all month & the ensemble just got lucky.</comment></comment>