Show HN: I made a free game to fight coronavirus (100% of profits go to charity) - <AUTHOR> http://www.bioblast.me <comment><AUTHOR> I got the idea from an article I read about how much candy crush makes everyday ($2.5m) and thought it would be truly amazing if these funds could be used for coronavirus relief.</comment>


RightNow Technologies: Bootstrapped to 230 employees and $30M in sales - <AUTHOR> http://www.inc.com/magazine/20020201/23855.html <comment><USER2> That article is 9 years old...that company is a completely different animal now.</comment>


Email banned at 75,000-employee company - <AUTHOR> http://abcnews.go.com/blogs/business/2011/11/tech-company-implements-employee-zero-email-policy/

<comment><USER2> Lots of the comments here are missing the point. In my experience at enormous companies (that have had e-mail policies, in varying degrees, like this one), they have zero to do with productivity and have everything to do with the various laws, rules, and regulations surrounding data retention of e-mail.

To put this in the best possible light, consider a rogue manager of a publicly traded company, who is discovered by the company and subsequently fired. If he does something bad with a legally-mandated paper trail, we're talking about discoverable material that would show up in any serious lawsuit about an unrelated matter. If we're talking about a crazy internal system that deliberately never logged anything in the first place, the company is open to much less legal liability.

<comment><USER3> Forgive my ignorance, but if a company exists in an industry with mandated data retention/logging, wouldn't those laws apply equally to IM as to email? In other words, if the law requires that internal communication be logged they'd be screwed either way in your scenario.

Maybe the laws in question are so narrowly crafted that they apply only to email, I don't know. Seems like a strange justification for the switch though.

<comment><USER4> >wouldn't those laws apply equally to IM as to email? In other words, if the law requires that internal communication be logged they'd be screwed either way in your scenario.

then how about oral "instant messaging"?

</comment></comment></comment><comment><USER5> I don't understand why usenet-like newsgroups have not caught on for internal company communication. A large part of typical internal email is sent to multiple recipients, such as everyone working on a project. A typical email client makes a total hash of this as people break off into side discussions of various parts of the various emails. Messages are either giant because people quote the entire previous thread, or they are confusing to anyone who comes in late if the entire thread is not quoted.

With a newsgroup, you've got a nice threaded discussion. If some people start discussing something you aren't interested in, it is easy to skip those messages. If someone comes in late, they can see the past messages.

If I were setting up the internal communications for a company, I'd consider newsgroups, with a newsgroup per project and a newsgroup per department, as the main non-private method for project and department discussion. IM would be used for short things that you want a quick response on. Email would be used for one on one things that are not appropriate for the newsgroups and too long or not urgent enough for IM. Probably have a wiki or something like that for evolving documentation.

<comment><USER6> I worked at a rather large company that did this and the newsgroups turned into total chaos. Posting to the newsgroup didn't have the same social stigma attached as sending a mass email or hitting "reply to all." This led to people posting rants, the latest chain messages, and some pretty off color things. Of course, management went ape over this and decided to just scrap the entire system instead of fixing the cultural problems.

<comment><USER7> At the very least it seems like the system should have been left in place to collect the noise and then most people could just ignore it.

</comment></comment></comment><comment><USER8> "That's why he hopes the company can eradicate internal emails in 18 months, forcing the company's 74,000 employees to communicate with each other via instant messaging and a Facebook-style interface."

So, basically, let's eliminate the form of electronic communication that has some semblance of permanency (e-mail) and replace it with an ephemeral one (Facebook-style chat) and one that doesn't lend well to archiving, indexing and search (IM).

E-mail is a tool. Like any tool, it can be used wisely, or it can be used poorly. If it's being used poorly, why isn't the solution to fix how people are using it? And how the heck is _18% of the e-mail that reaches users spam_? Do they not use filters?

<comment><USER9> Why would it be hard to archive and index chats or IMs? My Facebook chats and IMs are already archived on Facebook. I even have a local archive in my iChat folder. Seems like that problem has been solved.

The article just means his company is shifting to something like Jive instead of Exchange.

Maintaining an internal mail system is a gigantic headache for many reasons. You have continual spam and phishing attacks from the outside as well as internal users using their email as a document repository. Closing off the external threat and using purpose built software for document exchange and internal communication is totally sensible.

<comment><USER8> There are all kinds of risks in letting Facebook handle the archiving of a company's internal communication, their bad track record with matters of data privacy notwithstanding.

<comment> brown9-2 the article says "Facebook-style", not "Facebook".

<comment><USER8> The post I'm replying to is specifically talking about saving Facebook chats.

</comment></comment></comment></comment></comment><comment><USER10> Let's hope they are collaborating with some real researches to measure the impact of this. It's definitely a super interesting and plausible experiment.

I have a love/hate relationship with email. It's definitely good in theory, but in reality there are hundreds of problems with it.

One example: I get hundreds of CC'd emails a day ( I'm CEO ) and people assume that I read them and memorize them. Sure, it's a super low overhead way for other people to update me on all sorts of progress. However, I don't need that kind of visibility. I train people to make decisions autonomously and give me weekly updates. I can do that because I'm everyone's boss and I'm still drowning under the flood of well meaning CCs. I'm sure it's worse for most.

</comment><comment><USER11> "Ban" is probably not the right action, but I'd definitely like some action taken around my office.

I've proposed some form of email tax by recipient. Like, you get 100 recipients per day free or something. Slow down and use them well. The time you try to save by being vague and sending out garbage is time that all your recipients spend trying to figure out what you want from them and whether it's more important than whatever else they're doing.

I see lots of emails floating around where I have to respond, "Please file a bug and move the conversation there before all of this is lost." Then you get the, "I just got a new cat!" email sent to all with hundreds of, "yay!" responses. I'm glad you got a new cat. I'd be happy to "like" your post on yammer. I'm not happy to get an email every time someone else wants to congratulate you on your cat acquisition.

I build up a lot of email debt and every once in a while I manage to get rid of some things. Part of it is tooling (I'd like a sort of "shelf life" for email in my mail reader), but part of it is just how easy it is for humans to do the one thing that amplifies into a time sink for everyone else.

</comment><comment><USER12> I agree that email is a tool and that the way it's used is most of the battle. But I feel, more and more these days, that email is a heavy chain around my neck throughout the day.

Actually, email is really only a delivery method, just as facebook message or skype IM is just a delivery method. I think the solution to this problem is what the client does on receiving that message (or probably what my mail server does).

If my boss sends me a job he wants doing, then that message should go into a to-do bucket, with a due date and reminders. If that message is telling me that a domain name was auto-renewed for £x, it should ping my online accounts software and reconcile it with the bank transaction.

Doing this would eliminate the need for me to have an inbox, all of these things would go somewhere useful and actionable.

Stopping emails will not stop people sending me blocks of text that I need to read and process.

</comment><comment><USER13> The biggest problem with email is how much information is in private emails instead of public forums. If I want to learn something internal to my company, I have to spend days investigating who to ask, then go to a bunch of conference calls or meetings, only to receive a 700-forwards-deep piece of documentation from someone who was laid off decades ago. In the real world, I type my question into Google and have an answer in seconds.

The problem is that most people at big companies suck massively at communication, and that that lack of skill wastes thousands of hours of valuable programmer time. The only way I can have a really productive day at work is to stay home, keep my email closed, and not work on systems that depend on any shared infrastructure. No wonder our market cap is less than our assets :)

</comment><comment><USER14> Sounds a little like this: "people could choke, better ban eating".

</comment><comment><USER15> My company has great spam filters. Our problem is the chatter, reply-to-all, and +{some list with 300 people} behaviors.

Two months ago, I implemented the nuclear rule on my inbox. \- if my email is not in to or cc \- if the mail isn't sent to whitelisted lists \- if body doesn't contain certAin keywords -> the mail is stored in a "not sent to me" folder which I check less and less frequently. Merlin Mann definitely inspired this experiment.

It's been working great. I've been more productive and have missed very little.

</comment><comment><USER16> If they only want to have employees contact each other, why not restrict the email to internal use only? Have the server block any email not sent by another employee or being sent to a non-employee. Removing it altogether and requiring communication by IM does not scale - can you imagine going on vacation and coming back to hundreds of IMs?

<comment><USER11> A very large percentage of my day is spent reading emails from other employees in my company to figure out if there's anything I should be doing with it.

If I'm on vacation, I'm not online to receive an IM. Anything important that needs work from me would have instead been filed as a bug and can be assigned to me on my return if it hasn't been fixed yet.

</comment></comment><comment><USER17> My younger (and very productive) co-worker has his IM client running by default and uses it to communicate with other (young) co-workers. Frankly, I don't know how they do it. I would go mad - the constant notification popups in the upper right corner kill my concentration. They're too distracting for me. But then again, I'm probably just getting old.

A former co-worker at a different company had a policy that he would only read/write email before noon each day. I think something like that may be a better strategy than discarding email altogether company-wide. When you need an answer right away, you could always use the phone. And for him at least this did not result in people dropping by his office or his phone ringing all the time.

<comment><USER18> I'm 22 and I can't stand IM notifications either.

</comment></comment><comment><USER19> Here's the thing... [1]

If you have a look back at how long the death of email has been predicted you can go about as far back as the first email service created. Not everyone adopted it.

If you want to go back to 2005 you might like the point of view of Stowe Boyd <http://sto.ly/uCnRMs> regarding this article. Also, I've been on talks/panels on the topic as far back as 2009 <http://bit.ly/9ENcpJ> and again in 2010 <http://bit.ly/bG7DVz> complete with a sad rendering of an inline Google Wave.

How do I feel now about email? Mixed.

What I do agree with is the notion of email as a lowest common denominator for exchanging information has a lasting value. What I do not agree with is that email is /enough/ for everyone.

Today, you have lots of choices in how you use email or elect to treat it (or ignore it) so that only the most relevant things are presented to you. If you are a company/corporation and you are planning to allow for employee communication the effectiveness of any solution is far removed from just email these days. If anything, we're generating more silos now than we ever have.

To the other comments here regarding Salesforce/Chatter, groupware, etc... I get that -- in fact I use that -- but there are still TONS [2] of people that steadfastly maintain that email is the only thing that lets them use their iPhone or Crackberry without jumping through the hoops of corporate VPNs or other hoop jumping exercises to reach a web groupware app that just fundamentally FAILED to ever take into consideration the mobile experience.

[1] Yay disclosure! <http://fudge.org/disclosure/> [2] totally scientific... yes, you can quote that

</comment><comment><USER20> There is also a risk that people start working around the policy by using webmail such like gmail in order to patch the communication problem. Which could make the problem even worst.

</comment><comment><USER7> This seems like treating a symptom and not the problem.

</comment><comment><USER21> I'm surprised at the lack of comments about Yammer. I used to think it would be a product I'd NEVER use, but for a recent year long project I used it with a team of around 20 others. The result was pretty awesome. Emails were rarely sent/received, at least internally, and this was not a policy (the use of Yammer over email just naturally happened). When email WAS appropriate (private discussions usually, or outside partners), it was of course used, but this was only around 10% of the time. Everything else was in Yammer, Campfire, or IM, and it was SO much better.

My favorite aspect of this was the ability to include someones username in a post (much like on Facebook, via @username). This would actually ping them to let them know their attention was required, otherwise you can keep up to date with Yammer threads at your own pace. This is not the case with email.

<comment><USER22> We have yammer at work. It's a total waste of a time sink.

Maybe I'm just old, but I much, much, much prefer stored systems like email which I can ignore when I need, keeps nice queue of what I've received/read, has folders/filtering/taging/search, ability to archive/save important messages.

Vs IM/Twitter/IRC constant stream systems. Which constantly distract me with msgs I care little about and when I ignore them it's easy to miss and hard to discover I missed something important.

</comment></comment><comment><USER23> Instant messaging is NOT a good substitute for email, because it requires that everyone be simultaneously available over an always-on Internet connection. Email in contrast enables asynchronous communication over unreliable Internet connections.

Wiki-style or Facebook-style application might SEEM better alternatives to email, but as soon as most people in the company start using these applications instead of email, guess what? All those superfluous, time-wasting messages that were clogging up the email system will start clogging up the new applications. It's human nature.

A much better approach IMO would be to transition away from old-fashioned corporate email applications like OutLook/Exchange to newer ones (like Gmail) that make employees more productive/efficient.

</comment><comment><USER24> Here's my test of whether a message should be sent via email: "Can I reply to it?" If the answer is no then it probably shouldn't be in email. Think about all of the do-not-reply@ messages that come in that are notifying you of something happening in some other system. email is for communication but too often is just used for broadcasting one way messages. If I had an easy way of filtering out these messages I could easily reduce my inbox by 90% - down to things sent by humans that I need to respond to. Everything else could go into some notification feed, the problem is that there's no standard protocol for that so everything ends up in your inbox.

</comment><comment><USER25> How silly. Employees will continue using e-mail to communicate with each other, except now they're going to use personal Gmail / Hotmail / Yahoo accounts to do it.

</comment><comment><USER26> While idiotic, his points have some merit. I'm known to crucify people that cc/bcc me as part of their "cover your ass" cc/bcc corporate email chains. I also found out early in life that 1 phone call can replace 10 email exchanges between two parties.

Whatever the fallout, it will make for an interesting experiment. Personally I think most of the staff will rely on personal email addresses :)

</comment><comment><USER27> plus it'll cut down on that pesky paper trail of communication if engaging in illegal acts.

</comment><comment><USER28> I wonder what this company will switch to when people are flooded with useless IMs and useless messages on their Facebook-style messaging system?

</comment><comment><USER29> Why are employees getting 200 emails a day?

<comment><USER30> A good part of that is episodic and accidental. There have been instances of those "spammy" internal mails that just can't give up, such as a mail sent by the HR to inform people that a car was left with lights on in the morning with everyone (and not just the building) in cc instead of bcc or a contact group, with endless streams of "reply all" asking to remove them from the mailing list.

These happen, and in very large companies these issues can degenerate fast unless your email admins are on their toes. Repeat the incident once a year and it's fine. Repeat it once a month and you have a failing email system with very visible streaks of 200+ mails/day.

</comment></comment><comment><USER31> They are still doing external email, so maybe this just adds disciple about external vs internal communications.

</comment><comment><USER32> French competitiveness is not going to threaten American interests, which is business as usual I guess.

</comment><comment><USER33> In other news, go.com is still a thing.

</comment><comment><USER34> This is one of those ideas that sounds good at first but I think they may rethink that.

Their points on the disadvantages of email are true and good but they may be overlooking its good points and the downsides to using IM.

Spam can be quickly deleted. While its an annoyance there are Ways to curb the amount received.

Lots of not useful email is sent but there are lots that _are_ useful.

The cool thing about email is that you can choose to ignore it easily and come back later. When you substitute IM for email you're opening a can of worms that can be worse. An IM is harder to ignore, people expect an instant response and people will still use it for communicating less than useful info still.

When you have an IM client open all the time you're going to have to context switch more often than with email. With email you may get a little alert via something like the Mail.app sound for new mail or a Growl type notification but you know it can wait. With IM you're going to be switching over immediately. Context switching kills productivity and this policy will make matters worse.

The better solution would to implement a policy that stops people from sending ridiculously not useful emails. They aren't solving the problem but just putting it into a new context.

But then I'm reminded of a story here on HN from a day ago from the Atlantic that talks about how folks like us can easily criticize but if we're so smart why aren't we running that company. It may not apply here but it just popped into my head.

<comment><USER35> What immediately struck me is having two forms of communication rather than one. I don't like that. The article mentions the company reduced it's email by some percentage in the last six months as if that means something. I know I'm more likely to send a stupid link to a coworker if I'm on chat vs company email.

<comment><USER34> Yep, you're exactly right. It's like replacing long form time wasters with short form time wasters. A context switch is a context switch whether it's from productive work to email or from productive work to IM.

</comment></comment></comment><comment><USER36> I applaud them. SMTP shouldn't reign forever.

<comment><USER37> Their problems seem to be people-related, not technology related. Most messages I receive on Twitter, Facebook, Google+, Yammer, IRC, and any other form of digital communication just aren't important. Email really isn't an exception here in my experience.</comment></comment>


COUCHDB based email messaging system with code - <AUTHOR> http://pylab.blogspot.com/2009/01/using-couchdb-to-build-email-messaging.html

<comment><USER2> Where is the code ?</comment>


Galaxy S3 close to beat iphone in sales - <AUTHOR> http://www.ft.com/intl/cms/s/0/a0fdc0f4-c459-11e1-9c1e-00144feabdc0.html#axzz1zY2twHMG

<comment><USER2> Paid article. Very smart.....

<comment><AUTHOR> I have no idea why it's behaving like that, it was working before I posted it here. :S

edit: if you go to the link they posted on g+ you can read the article. I'm not sure why, maybe it's checking the referrer:

[https://plus.google.com/u/0/113457471429583444041/posts/GDsk...](https://plus.google.com/u/0/113457471429583444041/posts/GDsk3fVWSEs)</comment></comment>


Crew Returns to Earth as Another Prepares for Launch - <AUTHOR> https://blogs.nasa.gov/spacestation/2018/06/03/crew-returns-to-earth-as-another-prepares-for-launch/ <comment><AUTHOR> Three crew members who have been living and working aboard the International Space Station have landed safely in Kazakhstan.</comment>


Purism builds a secure tablet with physical wi-fi and camera switches - <AUTHOR> https://techcrunch.com/2016/05/20/purism-builds-a-secure-tablet-with-physical-wi-fi-and-camera-switches/ <comment><USER2> That's a ridiculous price. I just got an older tablet and installed an aftermarket ROM without the Google frameworks. Then I put stickers over the cameras, and opened it up to disconnect the microphone and sever the electrical traces on the USB port so it only charges and doesn't allow for data communications.

When I closed the case up, I put some globs of epoxy on the inside so it wouldn't be possible to open it back up without major and obvious shell damage.

I do something similar with my laptops. I use older Lenovos compatible with Libreboot and just disconnect the microphones and cameras and seal up the ports with DMA memory access (firewire, eSATA, etc) and seal up the case.

It makes it so I can't repair them if something goes wrong, but since they're ancient machines they're very inexpensive.

<comment><USER3> $600 for a 10" Atom tablet, 4GB RAM, 64GB SSD, including the keyboard.

$1300 for a 11" Core-M5 tablet, 8GB RAM, 256GB SSD, including the keyboard.

Honestly doesn't seem that bad to me, if the product is well made. It's similar in price and processor specs to the Macbook (Core-M3, 8GB RAM, 256GB SSD for $1300).

<comment><USER2> Oh, I agree that the $1300 tablet has great specs. It needs them to run Qubes (which I run on my desktop machine)

I was just saying that if your primary goal is adding a bit of tinfoil to your desire for security and privacy, it's easy to just get an old tablet and modify it to remove some of the most common attack vectors and environmental observation capabilities.

</comment></comment></comment><comment><USER4> How do they deal with the intel management engine in all intel chips? [https://libreboot.org/faq/](https://libreboot.org/faq/)

<comment><USER5> AMD and ARM have them, as well. It's almost impossible to avoid these hardware backdoors.

<comment><USER6> ARM doesn't have anything like the Management Engine. It has TrustZone, but that's basically just a hypervisor-like mode that some manufacturers use to run software above the OS level. A lot of the common hobbyist-friendly ARM SoCs give the user full control over what if anything runs in TrustZone mode.

<comment><USER7> Related, a presentation by Raptor Engineering "The World Beyond x86" (video and pdf slides) [https://www.raptorengineering.com/TALOS/op_twbx86.php](https://www.raptorengineering.com/TALOS/op_twbx86.php)

They delve into x86's freedom and security issues, then discuss the pros and cons of ARM chips versus OpenPOWER chips.

For an open laptop such as Bunnie's Novena, ARM is a fine choice.

For Raptor Engineering's Talos Secure Workstation, OpenPOWER was a better fit.

</comment></comment></comment></comment><comment><USER8> I'm a big fan of attempts to develop free hardware, despite the higher price and other problems (serviceability etc.). But I really hope they'll make a better job with the kill switches than on the Librem laptop.

Firstly there are no labels, so it's unclear which switch is for what, or even the on/off position. Secondly, they've used switches that are entirely unsuitable for exposing on the edge of the laptop - after 1 week of usage one of the switches simply broke off when putting the laptop in a bag, and expect the same thing to happen for the other switches soon.

And it's pretty easy to change the on/off positions this wa, which is a problem because the camera/microphone has no led indicating the position.

</comment><comment><USER9> So it's a $1300 device, and they commit to building them if they get roughly 120 pre-orders.

That sounds like the sort of scale where the NSA will be intercepting every delivery pro-actively in order to install hardware tapping devices or other security bypasses.

edit: I would recommend that Purism take detailed photos of the insides, front and back, and put signed copies of them on the website.

<comment><USER10> I like the idea of putting a small amount of glittery fingernail polish over the screw, then taking a high res picture.

The idea is from Eric Michaud and Ryan Lackey's presentation at 30C3 (2013 CCC), but this is a decent writeup:

[http://www.wired.co.uk/article/data-security-nail- polish](http://www.wired.co.uk/article/data-security-nail-polish)

<comment><USER11> That's ingenious, I like it, cheap and effective.

</comment></comment></comment><comment><USER12> "You have to be a certain kind of paranoid to want a hardware kill switch for networking" – or just battle-weary from a shockpile of bad laptops where you had to suspend-resume/reboot/unplug battery to get your wifi card back up

<comment><USER13> Those cases are usually where the driver has got confused, in which case the hardware switch doesn't help much, IME.

</comment></comment><comment><USER14> And the microphone? I'm much more wary of microphone data being captured than camera data.

<comment><USER15> The hardware spec says it's a Mic/Camera kill switch, so it does block that too.

</comment></comment><comment><USER16> Wow, I'm pleasantly surprised. They're actually serious about their commitment to privacy; their website¹ amazingly doesn't contain _any_ third-party trackers!

――――――

¹ — [https://puri.sm/](https://puri.sm/)

<comment><USER17> I'm curious why they make a call to fonts.googleapis.com for Arial, sans-serif though....I was also pleasantly surprised to see uBlock didn't block _anything_ from their site.

For those curious: PureOS is a Debian fork. PureBrowser is an Iceweasel fork which itself is a Firefox fork. [0] Assuming this is the official repo, there are some concerns of mine that security updates are out of date.

[0] [https://github.com/purism/PureBrowser](https://github.com/purism/PureBrowser)

 _> PureBrowser takes Debian's Iceweasel and includes a number of the changes made for GNU's IceCat, along with some extensions that we like - privacybadger, ublock, https-everywhere, html5-video-everywhere, and decentraleyes.

>DuckDuckGo's search page is the default, as well as the homepage. _

</comment></comment><comment><USER18> As a libertarian, I don't like unnecessary government intervention, but with the case of physical switches, I'm willing to make an exception.

We need a legal requirement that you cannot sell a computer without physical switches for camera, audio, networking, and wi-fi. I think selling gear in any other configuration is too dangerous in a non-obvious way to the average consumer.

We can stop this now, or we can go on for another decade or two and try to stop it. It's easier done now, when we're first seeing how this is all going to turn out.

<comment><USER19> I'm a libertarian too, I don't like unnecessary government intervention, and I think this case is no different to any other "save them from themselves" kind of policy.

If people truly want to buy equipment that saves cost by removing physical switches, there's no reason the government should be stopping them.

<comment><USER18> If people want to engage in open and free trade and make an informed decision, I'm all for it.

The problem here is that you are effectively making an open-ended, infinite choice. You have no idea what that information could be used for. You might have grandkids who could suffer. There's no reasonable exchange here that makes sense for the individual.

So I just don't see how a free and informed choice could be made, since the person making the choice has no idea what they are choosing. This is a similar question to asking if people have the right to sell themselves into chattel slavery. I think the answer in that case is also "no". Indentured servitude, perhaps -- but that's a discussion for another day.

</comment></comment></comment><comment><USER20> I'm confused as to which OS this is running.

<comment><USER21> Qubes OS

[https://puri.sm/posts/purism-partners-with-qubes-security- fo...](https://puri.sm/posts/purism-partners-with-qubes-security-focused- hardware-and-software-together/)

</comment></comment><comment><USER22> They should offer a pick-up option to prevent any tampering in transit to make it seem more worthwhile.

I mean if someone is required to be that concerned about security I'm certain they will justify the costs to go pick-up a device versus risking having it compromised.

</comment><comment><USER23> Why not just make a case that does this? It could have doors that slide out to block/unblock the camera and microphone. And make it a faraday cage to block wifi and gps until you open the case.

</comment><comment><USER24> The only way to be secure is to not be online. If the NSA is targeting you, you've already lost.

</comment><comment><USER25> Am I silly for preferring the herd security provided by using vanilla iOS?

<comment><USER26> What security do you think you get from being in the herd?

<comment><USER25> \- No signalling effect

\- Quick and reliable disclosure of and turn around on vulnerabilities

<comment><USER27> > _" No signalling effect_"

Can you explain this point please. I've not heard it used in this context before.

> _" Quick and reliable disclosure of and turn around on vulnerabilities_"

Sadly there's only a very loose correlation between the popularity of a product and the corporations ability or willingness to disclose vulnerabilities or release patches in good time, nor even patch them at all (in the worst cases).

An apt example of this is how poor many OEMs are at pushing Android updates to popular tablets and smartphones. However I do appreciate you specified iOS and Apple are generally better at supporting older devices than many Android OEMs. But I'm replying to the "herd" point more generally.

<comment><USER25>
        > Can you explain this point please. I've not heard it
        > used in this context before.

What I was poorly trying to explain was my feeling that there's sufficiently little data flowing through Tor, and probably sufficiently interesting data in there, that my guess it's it's seen a lot of scrutiny for all sorts of attacks, and there's a real possibility nodes are storing traffic for future decryption when vulnerabilities are shown. I try and lock almost all of my data down to HTTPS over a VPN (F-Secure's Freedome), which my gut feeling is is probably a lot less exciting.

In the same vein, a device that's meant purely for TOPSECKRITDATA?! and has a small install base feels like a much bigger target as I'm signalling I have something I am explicitly trying to hide.

        >> "Quick and reliable disclosure of and turn around on
        >> vulnerabilities"

        > I do appreciate you specified iOS

Yeah, I probably didn't express this very well. But I _do_ trust Apple to take it seriously, and I don't think I could take seriously the idea of running an Android device these days from a security and privacy perspective, which is sad.

<comment><USER27> Thank you for the explanation. Your signaling argument sounds an awful lot like _security through obscurity_ [1], which I do read a lot and sympathise with to an extent, but unfortunately it can also be easily debunked.

Pragmatically, security needs to match the circumstances in order to get a fair balance between usability and security. For most people, hiding inside the noise is "good enough". However the issue arises if any one person gets the limelight thrust upon them for whatever reason. And we've seen examples of this with the phone hacking scandals in the UK and how some journalists also search social media accounts of previously unknown individuals who might hit the headlines. In situations like this, you can no longer hide your signal amongst the noise of the internet as you're not being specifically targeted.

So I guess the point I'm trying to make is the signaling argument only works because the odds are in your favour. But like with any game of chance, there's always the slim chance that you might be unlucky.

At least with stronger levels of security, your comms might be more visible in some circumstances, but at least very little can be ascertained from those comms. Generally speaking of course. However going back to your VPN vs Tor argument specifically, I do agree with you that the security benefits of Tor are largely overstated, so it's not something I use personally myself either.

[1] [https://en.wikipedia.org/wiki/Security_through_obscurity](https://en.wikipedia.org/wiki/Security_through_obscurity)

<comment><USER28> > Pragmatically, security needs to match the circumstances

> in order to get a fair balance between usability and

> security. For most people, hiding inside the noise is

> "good enough".

I'd say it is different. This "herd security" business only matters if your adversary is the NSA. In which case you will need a complex security strategy that goes way beyond just picking OS.

If on the other hand you just want devices that behave reasonably, then you should select your devices based on their behaviour.</comment></comment></comment></comment></comment></comment></comment>


Breaking the fundamentals (of an article page) - <AUTHOR> http://bokardo.com/archives/breaking-the-fundamentals/

<comment><USER2> Great -- a few lines that deplore the excesses of crude, intrusive Internet advertising, then segues into an advertisement for the author's book.

<comment><AUTHOR> I thought that made the point nicely though... you _could_ read the article first ;-)</comment></comment>


Hermancain.com 404 - <AUTHOR> http://hermancain.com/404

<comment><USER2> I find Cain's lack of depth on many issues frightening, but that's pretty awesome.</comment>


Ask HN: Annual Bonus Time, Team's Not Happy - le-mark I'm a manager of a team in a large company. Annual raises came out. I had a pool to divy up, which I did, and then my recommendations were ignored by higher management. The pool went else where, and my team got scraps.
This team is quite good, they really kicked ass last year. A lot of overtime on a very high profile project. Feedback I got was they expected more, and I did to.
So question; how to handle this? Worst case is I lose some people. Well maybe that's not worst case, maybe worst case it they disengage. <comment><AUTHOR> A lot of really poor advice so far in this thread. Unfortunately your personal best bet is probably to do nothing. If it really bugged you, find a new job silently because everyone is hiring.

The realistic answer is that you deliver the news to your team during your one on ones, explain the matter was not in your hands, and move on. If someone leaves over pay (which is reasonable) but you do not control pay, then it's not on you.

Don't be too hard on yourself.

<comment><USER2> This can probably be grouped with the "poor advice in this thread"

</comment></comment><comment> jags-v \- Raise this issue with the people who decide the pools and pay . The team did everything possible , if not addressed properly , one should not expect them to go above and beyond the norm.

\- Communicating to the team that you tried, is not good enough, because that is the least that is expected of you as the mananger ( if sounds rude, i am sorry , not the intention).

Potential Solution :

Making a case to the higher ups , showing them that retaining the great team is cheaper than hiring some one else over a period of 2 to 5 years would be helpful. Show them the impact on delivery of features,etc.

if this did not work, ask why so that , it does not repeat again or you can set expectations saying , this is what you get for what you are paying.

I am assuming , there is no equity involved in these discussions. Equity will change the whole dynamics of this discussion.

Potential Solution # 2:

The rewards need not always be monetary. If you can replace that , with something they want , say sponsoring their Apple WWDC trip or DisneyLand tickets or something , in a way that is not a HR nightmare, would be something to explore. That being said, it is tricky and will not work always.

Cheers.

<comment><USER3> That cost money either way. The best non monetary compensation you can give is comp days.

</comment></comment><comment><USER4> This is a tough situation. I'm hoping this discussion gets some traction because I would love to get some feedback from others in the community.

> I had a pool to divy up, which I did, and then my recommendations were > ignored by higher management.

Did you raise this back to higher management?

> Worst case is I lose some people.

The cost of losing a good person is much higher than whatever raise they might have gotten (in most cases). I would reiterate this point to the higher-ups.

</comment><comment><USER5> Next time, do not agree easily on overtimes for your team, if they are not paid generously. Companies say inspirational bullshit to encourage employees to work more than 40 hrs. In most cases, these sacrifices won't be rewarded, so your people will be miserable and feel betrayed.

</comment><comment><USER6> I guarantee you they're already disengaged if that's the feedback you got. I don't see anything you can do to get the money for your team. You just have to accept it. It's a shitty situation. Your engineers should leave if they can and they absolutely should disengage if not. That's life. That's what's going to happen barring some miracle from the execs or whoever controls the money. The execs should also know this, but most likely they are psychopaths and don't give a fuck. You seem to be a caring manager who is stuck in the middle. There's a reason these psychopaths put you there and it's to act as a cushion between them and what they consider disposable plebs. I hope they're at least paying you decent money for it. The fact that you get things done and complete the explicitly stated part of your job is for the psychopaths just icing on the cake. Of course, when you don't because your entire team is gone or disengaged, they'll have no qualms about letting you or them go. C'est la vie. This is the position you pursue as a middle manager.

</comment><comment><USER7> When you say elsewhere.. where did it go? What reason did they give for reallocating it? How's the company doing overall?

Edit: another question: how's the teams compensation compared to market?

</comment><comment><USER8> If the company performed well, and politics or weird accounting ju-jitsu is the reason for lower raises either across the board or in your department, you can push for the top 2-3 employees to be awarded RSUs or stock options, those usually are very well received and they're good retention mechanisms.

If somebody has ever come to you looking for a promotion or transfer (either works in this case), give them a great annual review (meaning: huge praise, no nitpicking) so they have a better chance at escaping your clearly underappreciated team.

Otherwise, give the news 1:1 (no team meeting for bad news please) and tell the truth, but not bitterly, and don't linger on the topic. Explain the priorities for next year.

As far as your own position, you need to figure out (with top management/your management) how your department is seen, who decides of the final allocation, and why you're getting scraps. Money is feedback and the feedback you're given is no one care about you or your team. No it doesn't matter if they say otherwise, what matters is their actions.

</comment><comment><USER2> Take a stand - ask for the funds under the condition that you'll resign if you don't get them. If you have to resign, tell your team why. The market is too good to tolerate this sorta thing from a company imho.

<comment><USER9> Sounds like 100% guarantee to be let go, because who would defend him? Top mgmt obviously considers him a low performer (or manager of a low-performing dept), as evidenced by the "scraps" they got. And the employees under him don't want to work for a manager perceived to be weak, who is unable to deliver at bonus time. (worse -- was unable to even prevent the bonus pool that was initially earmarked for that team to be taken away and given to another dept). Seems like both sides would have no problem replacing the OP with someone else.

<comment> swagasaurus-rex Sounds like a 100% bad situation.

Why stay where you are, in the most clear terms, unappreciated?

You're asking to be reorg'ed out of the company anyways. This is one case where following your pride is the right option. It's like ending a bad relationship; things will only get worse.

<comment><USER9> Never said OP should stick around long-term. But leave on his own terms, after securing employment elsewhere, or with some other plan. As opposed to laying down an ultimatum, in which case he could be shown the door in a matter of days.

Better yet, if he wants to express loyalty to his team, work his personal network on the side to get each of his team members hired at a more appreciative company, and be the _last_ one to jump ship, only after all the direct reports have safely been "rescued" via better employment opportunities.

<comment><USER10> This advice may be the "right thing" to do by the team but may not be legally sound, depending on the OP's contract with their employer. In fact it may not be legally sound even in the absence of a contract, depending on how a court interprets the implicit obligations between employer and employee. (I am not a lawyer and this is not legal advice, of course. Just consult one before doing anything like this.)

</comment></comment></comment></comment></comment><comment><USER11> ,`Feedback I got was they expected more, and I did to.'

Doesn't your company have a set criteria for bonus payout like for eg., Derived from overall company performance, department performance , down to team and individual performance? If it doesn't and you believe your team deserve a higher payout ,clearly the management team doesn't agree with that and so do you as you expected more. Without a set and agreed bonus payout criteria it is left to a committee or judgement of a few , who I believe have weighed the scenario of your teams morale going down and potentially losing a few people. They are okay with that. Clearly wherever the money have moved to is the area they all collectively value. I have seen this happen especially in the case of a team that is managing and maintaining a legacy environment tend to not get favourable bonus payout even when they put in extra hours but other teams who are working on the newer releases etc are favoured as they are the future systems.

</comment><comment><USER12> It depends on what alternatives you and your team have. If you think they think can easily find better employment elsewhere after they really showed up for you as a leader and put in the effort, doesn't really seem like it would make sense for them to stay. You don't get a lot of second chances as a leader, the deck is stacked against you in these cases. I think it would speak volumes about your character if you also showed up for your team when it sounds like they got short changed, at the same time you have to be strategic as well, only risk standing up for your team if you can take the downside risk and find employment elsewhere if management doesn't capitulate to your request..

</comment><comment><USER13> If you have a HRBP to go to, I'd suggest going to them with your concerns.

Different corps have different setups, but often a fixed pool across teams and staying relevant (+/\- X%) to market across teams is often a common thread.

Could you speak with your senior management, including HR and your Head, and seek to align your expectations with theirs. Sounds like something you need to sit down with them and voice concerns in a mature way, but don't expect an approval for extra budget. Doing this is prep for the coming assessment and salary adjustment cycle. HN can only do so much and that's often jumping to conclusions or a commentator being blinkered by their own experience only.

</comment><comment><USER14> Do a lot of companies do bonuses in March? Are there other ways to compensate the key devs? We have awards we can give out monthly. It's nice to compensate extra effort right when it happens.

</comment><comment><USER15> OP, if your company hands out bonuses in March/April you may wanna change your profile's email address... It was super easy to find out who you are, where you work, etc..

</comment><comment><USER16> Bonuses, or raises? Not clear.

Seems like this already happened, so there isn't anything to handle. Tell your people that your managers ignored your recommendations and that you're looking for a new job where they don't do that.

</comment><comment><USER17> The answer depends on your political position, goal, and capital in the organization.

Bonuses are done. They generally don't come out again. I would focus on understanding why and getting better positioned for next year.

</comment><comment><USER18> You have horse shit management. Been there. Not much you can do except tell him/her how you feel.

</comment><comment><USER19> This is on YOU.

</comment><comment><USER20> Leave

</comment><comment><USER21> So much of this thread is just people working off the assumption a bonus is part of your comp.

Its not. It's a bonus. If it's part of what you think of as your comp, you got shafted during negs when you got hired.

<comment><USER22> This might be your view of the world, but most people don't work that way. Companies often have "target bonuses". If most people don't get their it, and there was no big problem justifying it, people will quit.

</comment></comment><comment><USER23> Were they paid for their overtime?

<comment><USER14> Not op, but very unlikely if they are salaried in the US. I should know. I've been a salaried drone putting in way too many hours for years. ;)

</comment></comment><comment><USER24> I don't get the premise of the question. You say "they really kicked ass last year", and then "they expected more and I did to." Which is it? Did the team do well or poorly?

<comment><USER25> The team expected a bigger raise</comment></comment>


Ask HN: Where to apply as a creative junior web developer? - <AUTHOR>

I'm kind of stuck right now and am looking for job opportunities which allow me to expand my skills but also pay for my basic living costs (which are ridiculously low at the moment).
I have been looking for a job for three months now but haven't been able to find anything. And I don't think that I'm _too_ picky.
One problem is that I just don't know where to look (I live in Berlin, GER right now but I'm willing to move and would also work remotely).
I do backend development (Rails, Sinatra, Django), frontend development and design - I'm also interested in working with hardware (e.g. microcontrollers). I have experience in QA and concepting, too.
I don't want to work for "evil" people and I want to be allowed to speak out my own ideas. I want to work in an open-minded environment where creativity and new technologies are welcomed and not restrained.
Or is that already being too picky? :/
I know a lot of people who are just hustling along in jobs they hate for years because that's the way it is.
Or at least they tell that themselves and me.
I've been there, too but I don't want a job just for the sake of having a job.
Building something for months and seeing it being flushed down the toilet immediately is kind of hard -even if you get paid for it in the end.
Especially when you're just getting started working as a web developer.
If you can help me out or give some tips - this would be really great! If you want to know more about me, drop me a mail.
Thanks! :) <comment><USER2> <http://berlinstartupjobs.com/>

</comment><comment><USER3> <http://onedesigncompany.com/>

</comment><comment><USER4> <http://cando-ent.com></comment>


Coronavirus Distributes as Aerosol - <AUTHOR> https://www.medrxiv.org/content/10.1101/2020.07.13.20153049v1 <comment><USER2> FTR, note that this is modeling, not experimental evidence.

I'd love to see actual, hard experimental evidence on aerosol transmission (the latest Nature paper on it doesn't qualify: only part of the samples were actually used to test viral replication in cells, and only part of them actually had detectable virus).</comment>


Terror on Wall Street - <AUTHOR> http://www.damninteresting.com/terror-on-wall-street/ <comment><USER2> A useful reminder that terrorism isn't new or even worse now that in the past. In the 70s and 80s, palestinian movements were regularly blowing bombs and taking hostages, along with far left extremists. A lot of state sponsored terrorism in the 80s and 90s, from our new "friends" Iran and Syria. And a lot of that terrorism was home grown (IRA, ETA, left wing).

For instance in the EU: [https://en.m.wikipedia.org/wiki/Terrorism_in_the_European_Un...](https://en.m.wikipedia.org/wiki/Terrorism_in_the_European_Union) The number of attacks and number of victims has been pretty much consistent since the 50s with a small spike with the Madrid bombings.

What has changed is our sensitivity to terrorism which has become absurdly high. There are violent crimes happening every day which kill an order of magnitude more people. Gang violence alone in the US kills several 9/11 every year. There are thousands of knife attacks just in London every year. None of that even make it to the news anymore.

And the number of deaths linked to terrorism (1,100 in Europe since the 50s according to that wiki article) is dwarfed by things like death due to accidental drowning (35,000 _every year_ according to eurostat).

It is useful to remember this when we see politicians in pretty much every western countries throwing out of the window basic civil liberties in the name of the war on terror. The budget spent on anti-terrorism should be better spent teaching people to swim.

<comment><USER3> What terrifies people about terrorism is that it could affect anyone at any time, and there's no semblance of control over that.

You can reduce your odds of gang violence by not being affiliated with gangs or living in/near a ghetto. You can reduce your odds of a knife attack by not walking alone when it's dark. You can reduce accidental drowning by learning how to swim. There's not much you can do about terrorism other than not go in public or live in a remote area.

<comment><USER4> So then create shall-issue laws for concealed weapons nationwide and encourage ordinary, law abiding citizens to purchase and carry with them guns all the time. Also ensure that there are no exclusion zones, or else those become the prime target areas. If it is well documented that 1 in 5 Americans has a gun at any time, terrorists might think twice about their odds of success. Further, if they do carry out an attack, they won't be able to hurt many people before the people strike back.

If you want to put an immediate end to terrorist attacks the only way to do so is to ensure that there are people witnessing the unfolding events (so they know who are the good guys and who are the bad guys) and empower them to solve the problem right away. No matter how you slice it, you can't make 1 in 5 people permanent, paid police officers so you have to look at the citizenry. If you can't abide the idea of normal people carrying guns _everywhere_ then you need to learn to live with the idea that the police can't be everywhere all the time, and that these are the risks you take regarding terrorism to feel safe from your fellow countrymen who you deem untrustworthy.

<comment><USER5> I can't tell if your post is sarcastic or not. If you cannot prevent terrorist acts on your soil, the solution is pretty obvious then, it's not to give weapons to everybody or to hire 20% of your population as cop, it's just to be sure that you're not giving reasons to anybody to come and bomb you.

That's the only realistic & cost-efficient approach given the threat model.

<comment><USER4> That's a long term solution and one I am in favor of. But what do you do in the interim, between the time that the US stops creating more terrorists through bad foreign policy and the time that everyone who is angry enough to want to kill Americans for revenge is either dead or doesn't care anymore?

Edit: I am not being sarcastic at all. It will be _exceedingly_ difficult to get rid of all the guns in the US so suggesting disarmament is a non-starter here. That means that terrorists will be able to get their hands on guns if they desire. Which means that you need _someone_ to counter them with something. The logical conclusion is another person (preferably many people) with guns also. And since the police ratio in the US is on the order of 0.1% that's not going to give you an adequate response time as we've seen from mass shootings.

The real question is "would the cure be worse than the disease?" and while I personally think the answer is "no" that doesn't make me right. And given how much the left hates guns, I suspect that we'll never actually find out, so don't worry.

</comment></comment></comment></comment></comment><comment><USER6> > _The Washington Post referred to the bombing as an "act of war," though no > one could be certain who the enemy was._

Jesus, that sounds familiar. And this:

> _Wall Street soon became a symbol of patriotism in the eyes of the country, > and stock trading came to be viewed as an act of defiance against the > terrorists. Before the attack a number of outspoken citizens had decried the > unchecked growth of power underway on Wall Street, but many of those voices > fell silent in light of the new public sentiment. Those critics who > continued to voice their concerns were denounced as supporters of violence > and terror, a trend which rapidly smothered all public debate on the > matter._

There seems to be no surer way to solidify a political tendency that to murder people while demanding its opposite.

</comment><comment><USER7> I'm amazed that I had never heard of this incident.

<comment><USER8> Honestly it's hard to hear about such instances when it's past the birth year of most of our parents. If information isn't actively taught about historic events then we're left with the few who actively seek it that will know. I'd be willing to bet that by 2110 most wouldn't have heard of the September 11th attacks simply because the people who experienced it and many of their parents will be gone by then. It'll be relegated to the history books possibly to be replaced with bigger issues that happen later.

<comment><USER9> That event didn't shape humanity, whereas September 11 did. Here your schoolbook in 2110: "The world was recovering from the fall of the USSR. CIA had reduced operations in the middle east. Apart from minor crisis (Balkans, or 1998 crack in Russia), tensions were appeasing. On September 11, five places in US were hit by simultaneous terrorist attacks, the most famous being NYC with over 3000 deaths. The blame was immediately put on Bin Laden, who was searched for 10 years until his capture in 2011, and globally on Arabic people. USA raised CIA budgets, sent its army to Irak, Afghanistan and Pakistan, created illegal prisons, used torture against what was later proven to be civilians, sprung unprecendented measures for security. In the middle east, the recovery from the Cold War was replaced by a constant storm of missile strikes. Military started using automated robots such as the Predator, spreading a worldwide solidarity among arabic people. In the USA, impacts were high on civilians. In airports, people were arrested for not being able to explain where they were going, military tanks started being used in USA police stations, military methods were used to bust poker parties, killing hundreds of Americans per year, and NSA was in charge of establishing a permanent control on all private communications. In 15 years the most powerful country of the world became able to squash any interior political movement with military methods. Worst of all, a poll showed that 40% of the population believed that September 11 was an attack organized by the CIA to renew the nationalist sentiment."

> It'll be relegated to the history books possibly to be replaced with bigger > issues that happen later.

Maybe not, if it's the root explanation of said later events.

<comment><USER10> What unexplained event, potentially terrorist, catalyzed the US engagement in the Spanish—American war?

Similar sorts of geopolitical consequences, similar timescale... the ease with which you recall the event is likely similar to the ease with which inhabitants of the US in 2115 will recall September 11.

<comment><USER11> For those who don't know, the parallels are unnerving.

[https://en.wikipedia.org/wiki/Spanish%E2%80%93American_War#U...](https://en.wikipedia.org/wiki/Spanish%E2%80%93American_War#USS_Maine)

</comment></comment></comment></comment></comment><comment><USER12> If you go to 47 Wall street just 25 feet from where George Washington was inaugurated as president, you can see chunks of marble missing on the wall where the shrapnel hit.

<comment> bro-stick Yup.

Btw: it's kind of shocking to see concrete and metal garbage receptacles (shrapnel-enhancing, hiding systems) in the US, after working abroad in FR and UK. These things need to be proactively replaced with tiny alumin(i)um hoops and clear plastic bags. Even the HS I went to in the 90's had a pipebomb issue at some point and hence no lockers.

<comment><USER13> I would argue the exact opposite. We need more "life goes on" and less fear.

Like how the stock exchange opened the next day.

I mean, changing garbage cans, really, is fine. It's not a huge cost and doesn't make it hard for us to continue to live our lives. If making a change to the garbage cans makes you feel better, go ahead.

But think of the incredible cost of implementing the level of airline security we have now. For anything under four hours, you are better off taking a car. Sure, we're trying to improve our rail infrastructure to the point where that's an option, too, but we're a long ways off.

The terrorists did some damage, sure... but the actual damage they did in the September 11 attacks has been dwarfed, at least economically, by the fact that we have essentially ruined our air-travel system in response.

<comment><USER14> > We need more "life goes on" and less fear.

Thumbs up for that. And respect to Boston for the way they handled the marathon bombings back in 2013.

> the actual damage they did in the September 11 attacks has been dwarfed, at > least economically, by the fact that we have essentially ruined our air- > travel system in response.

That however is a one-sided statement. The question is always: how many attacks did we prevent with the new security? You can't just weigh up 9/11 vs. the cost of airline security. You have to see 9/11 _plus_ any attack that was prevented (which I agree is hard/impossible to measure) vs. our security costs.

I don't deny that some air-travel security is OTT. But you can't claim it's pointless.

(Quite apart from the fact that customers, out of fear, nowadays probably wouldn't fly with an airline that didn't provide an insane amount of security. Despite an almost century long track record of astounding safety, the air- travel industry still has to convince its customers all the time that flying is safe.)

<comment><USER15> > But you can't claim [new airport security is] pointless.

Actually, we can: [http://abcnews.go.com/US/exclusive-undercover-dhs-tests- find...](http://abcnews.go.com/US/exclusive-undercover-dhs-tests-find- widespread-security-failures/story?id=31434881)

TL;DR: "undercover investigators were able to smuggle mock explosives or banned weapons through checkpoints in 95 percent of trials"

To the extend increased security around air travel deterred anything, it's in the non-airport-screening efforts -- increased/better intelligence is a very plausible source, and the reinforced cockpit doors another.

</comment></comment></comment></comment></comment><comment><USER6> Have terror bombings _ever_ accomplished the bombers' demands? Every one that I've heard of just seems to mobilize people to do the opposite of whatever they think the terrorists want, as violently as possible.

<comment><USER16> Gwern has an amazing essay on this:

[http://www.gwern.net/Terrorism%20is%20not%20about%20Terror](http://www.gwern.net/Terrorism%20is%20not%20about%20Terror)

And also: [http://www.gwern.net/Terrorism%20is%20not%20Effective](http://www.gwern.net/Terrorism%20is%20not%20Effective)

>In a [previous study of mine] assessing terrorism's coercive effectiveness, I found that in a sample of 28 well-known terrorist campaigns, the terrorist organizations accomplished their stated policy goals 0% of the time by attacking civilians.

>Jones and Libicki (2008) then examined a larger sample, the universe of known terrorist groups between 1968 and 2006. Of the 648 groups identified in the RAND-MIPT Terrorism Incident database, only 4% obtained their strategic demands. More recently, Cronin (2009) has reexamined the success rate of these groups, confirming that less than 5% prevailed…Chenoweth and Stephan (2008, 2011) provide additional empirical evidence that meting out pain hurts non- state actors at the bargaining table. Their studies compare the coercive effectiveness of 323 violent and nonviolent resistance campaigns from 1900 to 2006. Like Gaibulloev and Sandler (2009), the authors find that refraining from bloodshed significantly raises the odds of government compliance even after tactical confounds are held fixed. These statistical findings are reinforced with structured in-case comparisons highlighting that escalating from nonviolent methods of protest such as petitions, sit-ins, and strikes to deadly attacks tends to dissuade government compromise. Chenoweth and Stephan employ an aggregate measure of violence that incorporates both indiscriminate attacks on civilians and discriminate attacks on military personnel or other government officials, which are often differentiated from terrorism as guerrilla attacks (Abrahms 2006; Cronin 2009; and Moghadam 2006). Other statistical research (Abrahms, 2012, Fortna, 2011) demonstrates that when terrorist attacks are combined with such discriminate violence, the bargaining outcome is not additive; on the contrary, the pain to the population significantly decreases the odds of government concessions.

</comment></comment><comment><USER17> Isn't a bit bizarre from the author to point the finger to Italian anarchists for this unsolved case? I mean the "pair of Italian-American anarchists had been indicted five days earlier for bank robbery and murder" he mentions are none less than Sacco and Vanzetti, who were victims of one of the most spectacular miscarriages of justice willingly perpetrated for political reasons I can recall. To find an Italian anarchist guilt of something in the US during the 20s proofs were not really a requirement, so this case wouldn't end up unsolved.

<comment><USER18> > Isn't a bit bizarre from the author to point the finger to Italian > anarchists for this unsolved case?

It's the investigators that are pointing the finger, not the author: "Investigators immediately suspected that the bombing was the work of Galleanist anarchists"

<comment><USER19> The author chose how much context to include. Not to even mention the issues that most historians have with the treatment of S&V, while mentioning the case in apparent support of a completely opposed proposition, is odd in a work of this length.

<comment><USER20> Author of the article here. I did not intend to imply support for the conclusion that Galleanist anarchists were to blame. To the contrary, I feel the response of the public was misdirected and the response of the government was heavy-handed. Hence my phrase "the orgy of misguided justice."

<comment><USER17> I understand and I hope you'll forgive my nitpicking. It's just that when I read the paragraph with the Sacco & Vanzetti reference, I got the vibe of something in the lines "look what else the Italians were doing" and that rubbed me the wrong way. I would have much preferred something like "were _wrongly_ indicted of", to avoid the misunderstanding. I hope this comment will be taken not as a void critique by somebody who got offended, but as a reminder that phrasing is important to not to have your writings be interpreted the other way around.

<comment><USER19> I write obnoxious comments all the time, and I can't recall when I've been downvoted as much as this thread. It's clear that you and I and our non- psychic reading habits have touched a nerve with this author and his band of acolytes.

<comment><USER20> > this author and his band of acolytes.

I'm just keeping you distracted while my minions and I complete construction of my doomsday device. Mwahaha, etc.

<comment><USER19> Haha, touché! b^)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> So there was an attack on Wall Street and The US didn't immediately invade an unrelated middle eastern country? How times have changed...</comment>


Survival Of The Sluggish: Scientists Find An Upside To A Low Metabolism - <AUTHOR> https://www.npr.org/2018/08/24/641623213/survival-of-the-sluggish-scientists-find-an-upside-to-a-low-metabolism <comment><USER2> Relevant animals: greenland sharks. ~20 ft sharks slowly, slowly drifting at approximately 0.5 mph around the North Atlantic and killing time until they bump into some edible decomposing thing. They reach sexual maturity at about 150 and kick off around 400 [1].

[1] [https://en.m.wikipedia.org/wiki/Greenland_shark](https://en.m.wikipedia.org/wiki/Greenland_shark)

</comment><comment><USER3> In some science fiction movies (for example "Life", "The Green Slime") the alien life forms grow incredibly fast. If that works or is possible, it makes one wonder why no terrestrial life-form didn't adapt a similar strategy. In the above movies the fast life-form in question does come from a dead planet (the probable outcome of such strategy, but not really something evolution has enough time to select against).

<comment><USER4> >"In some science fiction movies (for example "Life", "The Green Slime") the alien life forms grow incredibly fast. If that works or is possible, it makes one wonder why no terrestrial life-form didn't adapt a similar strategy."

Really? Bacteria can divide every twenty minutes and human T-cells once per hour. Lets say you've got one bacteria cell living in your pipes at midnight, by the next day you could have up to 2^(3*24) = 4.722366e+21 cells. At 1e-15 kg per cell[1], that would be 4,722,366 kg worth of them.

The limiting factor is food, not ability to divide.

[1] [https://en.wikipedia.org/wiki/Orders_of_magnitude_%28mass%29](https://en.wikipedia.org/wiki/Orders_of_magnitude_%28mass%29)

<comment><USER3> And in the movies the life forms don't limit division, and probably exhausted the food (hence the barren planets they come from).

<comment><USER4> The mass of the earth is ~6e24 kg[1]. That would require 133 divisions: 2^(133)*1e-15 = 1e25 which works out to under two days.

I'm just saying that life can grow very fast under the right conditions... Do you really want it to be able to grow faster than go from a single cell to the size of the earth in 2 days?

[1] [https://en.wikipedia.org/wiki/Earth_mass](https://en.wikipedia.org/wiki/Earth_mass)

<comment><USER3> No, I don't believe I said that. I think I mentioned it would be bad in the first note. It just is if something could do that in general conditions it is an absorbing or end-state.

</comment></comment></comment></comment></comment><comment><USER5> > New research suggests one effective evolutionary strategy: be lazy.

Now research Impatience and Hubris!

<comment><USER6> > Now research Impatience and Hubris!

Do it fast, but we already know the answer.</comment></comment>


Microsoft's Power Play - <AUTHOR> https://www.mobileiron.com/en/blog/Microsofts-power-play <comment><USER2> When I hear the word "leverage" I remember it was a favorite of a young Donald Trump in the 1980s.</comment>


Judge Forces Apple to Help Unlock San Bernardino Shooter iPhone - <AUTHOR> http://www.nbcnews.com/storyline/san-bernardino-shooting/judge-forces-apple-help-unlock-san-bernardino-shooter-iphone-n519701 <comment><USER2> > The judge ruled Tuesday that the Cupertino-based company had to provide > "reasonable technical assistance" to the government in recovering data from > the iPhone 5c, including bypassing the auto-erase function and allowing > investigators to submit an unlimited number of passwords in their attempts > to unlock the phone. Apple has five days to respond to the court if it > believes that compliance would be "unreasonably burdensome."

Somehow I doubt any of that's possible.

</comment><comment><USER3> Well, good. It should require a court order (and the associated paper trail) before Apple opens up private user data to scrutiny.</comment>


Boring SSL - <AUTHOR> https://www.imperialviolet.org/2014/06/20/boringssl.html <comment><USER2> Theo's opinion about BoringSSL and LibreSSL portability: [http://article.gmane.org/gmane.os.openbsd.tech/37174](http://article.gmane.org/gmane.os.openbsd.tech/37174)

</comment><comment><USER3> So from what I understand, Google has a bunch of OpenSSL patches they use. They used to re-apply those patches to each new OpenSSL release, but now they're going to keep their own branch (BoringSSL) and pull and merge changes from OpenSSL?

What are the costs/benifits of one method over the other?

<comment><USER4> I think the costs and benefits are pretty much what you would expect. If your diff from upstream is small, then the tradeoff strongly favours rebasing against upstream and tracking it.

However, as the diff becomes larger, the tradeoff shifts. I think we passed that point a while back but, since we were going to switch models anyway, I took some time to clean up some bits of the code too.

<comment><USER5> I'm not so convinced about the tradeoff.

With your own patches you know exactly the reason and intent for each one - you wrote it! So you can rapidly figure out what to change to make them fit with the new release.

But in reverse you are going to have to grok every new change sent your way, and that it going to be a massive amount of work.

Some of it will be easy stuff: It's clear what they are doing, or it patches cleanly and you don't worry about it.

But then you'll run into more confusing changes and you're going to have a harder time. There is a human tendency to ignore that which you can not understand, and you'll have some of those, then a patch on top of them, and the final result is more work than you started with.

<comment><USER6> There is no singular "you". Google is a 50,000 person company. The 70 patches were likely written by dozens of different employees for different projects with different code bases. Some of authors may no longer even work at Google.

<comment><USER7> It's not a matter of trust:

[http://users.skynet.be/bs939021/artikels/group%20versus%20in...](http://users.skynet.be/bs939021/artikels/group%20versus%20individual%20performance.pdf)

Are N+1 heads better then one? The group is better then the average head. Heads are worse then the best head.

I do not know however if Google makes reviewing the patches more time intensive then it should be, it all depends on the rate of progress, isn't it?

</comment></comment></comment></comment></comment><comment><USER8> Great news! Hopefully between LibreSSL and BoringSSL, OpenSSL will go away and never return. I think AGL and the LibreSSL team will be able to do some fantastic informal collaboration. I'm looking forward to a healthy TLS ecosystem.

<comment><USER9> That's pretty brutal. One reason why Heartbleed was such a potential problem was the monoculture that tends to come when FOSS software becomes reliable and popular. Having more options out there is good, but I don't see why OpenSSL needs to go away. It had one major zero-day, then when people started paying attention to it, it got 1. a lot of attention to its security and 2. a not insignificant increase in much-needed financial support. Hopefully, we'll see more stable and well-tested TLS libraries out there, and the fact that there are now a few forks of OpenSSL is a good start.

<comment><USER10> Not that I necessarily disagree with you, but I do want to add two points for consideration:

 _1\. a lot of attention to its security_

That doesn't help if bug reports rot in the tracker for years. The developers' attitude might have changed under the current media attention, but for how long will that last? I have yet to read a public statement by the OpenSSL team on how they plan to improve code quality and processes in the long run.

 _2\. a not insignificant increase in much-needed financial support_

Even before Heartbleed, OpenSSL might not have been as poor as often reported: [http://opensslfoundation.com/what.html](http://opensslfoundation.com/what.html) [http://www.openbsd.org/papers/bsdcan14-libressl/mgp00008.htm...](http://www.openbsd.org/papers/bsdcan14-libressl/mgp00008.html)

Again, I am too much of an outsider here to judge, I just want to add these points for consideration.

</comment></comment></comment><comment><USER11> How, if at all, is this envisioned to interact with the work going on in LibreSSL?

I realize LibreSSL is optimized for BSD and Google is primarily Linux, but it seems silly to fork the code in 2 different directions.

<comment><USER12> Android already uses the OpenBSD libc (IIRC), so it's not inconceivable that they'll eventually do the same thing with libssl and switch to the OpenBSD implementation.

What's great about this, though, is that Google's contributions are potentially helpful in LibreSSL's eventual cross-platform porting efforts; their willingness to adopt the ISC license for their contributions is already a promising sign of that collaborative potential.

<comment><USER13> Totally agree. I love what libressl is doing and my great hope from this effort is that Google's people will port libressl PROPERLY onto Linux. That is critical for the parts where OpenBSD clearly states that the underlying OS must provide key pieces like random number generation, but the implementation must be done right and is often done poorly in initial ports.

<comment><USER12> I'm hopeful for that, too. Many of the qualms with the preliminary libressl ports revolve around (IIRC) the lack of exploit mitigation features in the operating systems being ported to; perhaps a proper port would be yet another encouragement for those features to be implemented in non-OpenBSD unixen (given that - from what I understand - both FreeBSD and Linux already have the code to support those features, and just need them to be enabled)?

</comment></comment></comment></comment><comment><USER14> Makes a hell of a lot more sense than rebasing 70-odd separate patches for your internal use! Making LibReSSL-portable is a good goal, and this work can be used to improve both (and OpenSSL, too - some of this found its way into the OpenSSL 1.2 branch).

I think the "safe" (EC)DSA nonce implementation is interesting but could use some review, and I've communicated that to the author: it's not as good as the proposal in RFC6979[1] (which uses HMAC_DRBG - which is good - to generate a truly deterministic DSA nonce, with test vectors and everything!). In particular, BN_generate_dsa_nonce from these patches uses modular reduction down into the prime order, which has a small bias towards 0 of course. The NIST prime orders aren't as close to powers of two as you might like to get away with that, and if I'm being honest, I'm not sure you can get away with _anything_ with (EC)DSA - it is extraordinarily fragile in a way I think was always deliberate. The practical impact is probably limited, but I really don't want to take any chances there. (Ideally I'd want Ed25519, or something very like it - there really ought to be some more discussion on CFRG about that - although it's going to be quite some time before anyone can roll it out in certificates widely.)

Right now, it's still lipstick on a pig. OpenSSL is hairy as fuck. Long-term, I think the LibReSSL cleanup-via-demolition approach and then carefully rebuilding what's left over is what's needed. But I'm not sure I'd want to run LibReSSL in the middle of such fundamental reworking - and in the meantime, some of these patches look quite familiar to me. :) ___ 1\. [https://tools.ietf.org/html/rfc6979](https://tools.ietf.org/html/rfc6979) \- Deterministic Usage of the Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA)

<comment><USER14> Bug filed, btw, response received, it's probably going to be replaced with a better implementation.

</comment></comment><comment><USER15> Moderators: Name should be BoringSSL, not Boring SSL. It is the tentative name of Google's OpenSSL fork.

<comment><USER16> Yeah, I agree. I thought this was an article about someone claiming SSL is boring. BoringSSL makes it much clearer that its referring to something with that name.

</comment></comment><comment><USER17> Yet another vendor implementation, yet more divergent behavior to be expected...

<comment><USER18> What are some good examples of a vendor implementation that has divergent behavior that affects users negatively?

<comment><USER19> Google and XMPP

<comment><USER20> That history has been really sad from the Android side too, not just the users who can't chat together any more. In the first Android beta there were a lot of XMPP classes that were really powerful, if you had all the right permissions and the user had the other people friended and running the same app, you could fire system events (intents) right in the other app through them. But in the second beta the XMPP classes were renamed GoogleTalk classes, and then on release they were all taken away. Now every app has to include a huge smack lib to have even less power than they had in the beta.

</comment></comment></comment></comment><comment><USER21> offtopic... that is a pretty bad custom font (might as well stay with the defaults)

<comment><USER12> At least it's not Comic Sans as the OpenBSD/LibreSSL folks opted for ;)</comment></comment>


Revolver: An Automated Approach to the Detection of Evasive Web-Based Malware [pdf] - <AUTHOR> https://seclab.cs.ucsb.edu/media/uploads/papers/usenix2013_revolver.pdf

<comment><AUTHOR> I was wondering if the PoC source code of Revolver is made publicly available. I was hoping to use it in my graduation project :)</comment>


Stuxnet Sux or Stuxnet Success Story? - <AUTHOR> http://www.securityweek.com/stuxnet-sux-or-stuxnet-success-story

<comment><USER2> > Then there are the two privilege escalation issues I can't discuss yet > because of responsible disclosure issues;

Known privelege escalations, used in the wild to attack nuclear power stations and you can't disclose them? That's irresponsible non-disclosure in my book.</comment>


Ask HN: What are your favorite conferences? - <AUTHOR>

What are your favorite development conferences? (And what technologies do they focus on? Windows? Linux? Embedded development? Ruby?) <comment><USER2> Velocity = all about performance [http://velocityconf.com/velocity2014/public/schedule/grid/pu...](http://velocityconf.com/velocity2014/public/schedule/grid/public)

[http://www.apachecon.com/](http://www.apachecon.com/) which is 50% about search (Lucene, Solr etc) and big data these days

I'm keeping an eye on QCon ([http://qconlondon.com/schedule](http://qconlondon.com/schedule)) but found it kind of expensive.</comment>


New privacy friendly search engine Yase, join the beta and submit feedback:) - <AUTHOR> https://www.yase.pw <comment><USER2> What would be the primary reason for using Yase over a well-established privacy-oriented search engine like DuckDuckGo?</comment>


Extreme Power of Black Hole Revealed in Chandra/Hubble composite photo - <AUTHOR> http://www.nasa.gov/mission_pages/chandra/multimedia/extreme-black-hole-power.html

<comment><USER2> > _Shock fronts - akin to sonic booms - caused by the expanding cavities and > the release of energy by sound waves reverberating through the hot gas > provide a source of heat that prevents most of the gas from cooling and > forming new stars._

OK, it's not perfect vacuum, so there is a very cold and very thin gas, so it can transmit sound. It is theoretically correct, but nevertheless I feel it's very strange to read about sound in the middle of the space.

</comment><comment><AUTHOR> Event horizon or not, still impressive.</comment>


Mudita Pure: a modern take on a classic phone - <AUTHOR> https://mudita.com/products/pure/ <comment><USER2> Another expensive phone like The Light Phone that seems to ignore the existence of feature phones.

$300 is vastly overpriced for either this or The Light Phone. On top of that, you have to deal with a long wait and a company without any sort of track record.

What you really want is $80 basic cell phone that's already sold by the likes of Nokia, Alcatel, etc and given away for free by prepaid phone carriers.

The disturbing part is that the "premium" features of this phone are sold as snake oil for the paranoid.

> You can choose between white light and the sunset light, which is closer to > red. It promotes the secretion of melatonin, resulting in an improved > sleeping quality.

Let me get this straight, they're claiming that this phone's flashlight will help you secrete melatonin? That's a big fat "citation needed" and an outright lie.

A low SAR value is similarly not a feature. Are they even being specific about how their value compares to other phones? They seem to just say "ours is lower, trust us." And their SAR page is incredibly misleading, and even though it's very long it doesn't even seem to tell us what the value is for this phone. Is it lower than a typical iPhone? We don't know. We are just treated to a bunch of WiFi sensitivity paranoia and what I can only assume are misleading citations of scientific studies.

> That is not to say that extended exposure to non-ionizing radiation isn't > harmful, we know that it is.

I don't know that it is. You're telling me that it is to try and sell a $300 feature phone, on IndieGoGo, where you can just take my money and run.

<comment><USER3> You're behind the times on the red light/melatonin feature. It's now built into probably every major OS. Windows calls it Night Light. Apple calls it Night Shift. Android calls it Night Mode. I used to use the f.lux app on Linux but now it's built into GNOME. Try it out, it's pretty easy to feel the difference, IMO.

<comment><USER4> I don't think he is talking about the screen, they advertise it for both the flashlight and the backlight. The quote comes from the flashlight of the phone, which has two models, one white and another "sunlight-like" for melatonin.

But the whole thing makes me wonder, who uses the flashlight that much (near her eyes) for it to even start affecting your circadian rhythm.

TL;DR: The screen sure, the flashlight, I doubt it.

</comment></comment></comment><comment><USER5> I don't see the solution that this phone offers that can't be resolved by purchasing older generation phones.

It looks aesthetically beautiful and the technology behind is great, but it's a solution looking for a problem. Like all the concentration apps/services that people are installing, turning off is a problem of the mind/body that can't be fixed by going 'we need more tech up in here'.

</comment><comment><USER6> The problem is that, I use skype and whatsapp and my primary contact points and I need these in a basic phone.

<comment><USER7> If the goal is purely to limit distraction on the device, a lack of maps is another deal-breaker for me on any phone.

<comment><USER6> Self Control is an art, however my goal is not to limit distraction, but to have a small feature phone ( whatsapp, skype, gps (maps)) and a nice tablet for everything else. The requirements are being met by smartwatches+ smartphones+tablets but that is one too many devices for me.

</comment></comment></comment><comment><USER8> Genuine question for radio/medical people here.

Is there any value in advertising less "radiation exposure"? I thought this was an answered question, that cell phone radiation is non-ionizing and has no health effects.

And also, even if your cell phone isn't projecting, you're bathing in cell tower waves all the time (which is why you have a signal).

I'm sure the inverse square law probably applies here as far as strength but the overall point holds, correct?

<comment><USER9> non-ionizing does not mean no health effects. this is the lie.

</comment></comment><comment> cody-code I would actually be interested in something like this if it were open source. But as it is I actually need a few services like telegram to be on my phone, and here I can't even program it into the messages app myself.

</comment><comment><USER10> I have a caterpillar b35 phone. Battery last long. You don't fiddle and waste time with it. Also has an iPhone. It's good to relearn to be offline. Ie not a mobile phone zombie :).

</comment><comment><USER11> I really hate that the screen is a different color from the chassis

</comment><comment><USER12> One can buy a brand-new Nokia 10X phone for about $25.</comment>


Russia Extends Edward Snowden's Asylum - <AUTHOR> https://mobile.nytimes.com/2017/01/18/world/europe/edward-snowden-asylum-russia.html <comment><AUTHOR> >> "More than a million supporters of Edward Snowden have petitioned President Barack Obama to pardon him, but the former National Security Agency contractor hasn't submitted the required documents for clemency, according to the White House." Source: [http://www.cnn.com/2017/01/17/politics/snowden-no- clemency-r...](http://www.cnn.com/2017/01/17/politics/snowden-no- clemency-r..). Forms: [https://www.justice.gov/pardon/application- forms](https://www.justice.gov/pardon/application-forms) ____ EDIT: Appears the only way to contact Ed is by Twitter: [https://twitter.com/Snowden](https://twitter.com/Snowden)</comment>


Understanding sudoers(5) syntax: a simple explanation (no EBNF) - <AUTHOR> http://toroid.org/sudoers-syntax <comment><USER2> This is good timing, was trying to wrap my head around this yesterday.</comment>


College Kids - <AUTHOR> http://blog.vorbby.com/post/10258088772/college-kids-or-the-people-you-meet-instead-of-the

<comment><USER3> I was in an Information Systems (BBA with an IT focus) degree program at a four year university in the United States' "Deep South". I got out of the college scene after 3 years and enlisted because I figured I could be working in IT faster (and leave the Armed Forces with relevant experience under my belt) if I left. (This was right before the economy tanked, so in retrospect it was an initiative bathed in some sort of fatefully unintentional clairvoyance.) I also figured that in going this route, I could get my foot in the door with various agencies that I would one day like to be working for. What you said about the government work really resonated with me, very true and I see it now. But I thought in college "these people don't really USE, nor are they interested in, the technology they're learning about" (this is an exception of course, some were). Now I'm saying, at my current position, "these people don't use at home, nor are they interested in, the technology they use at work" (this is an exception of course, some do). The difference in people between the two places: no difference. The difference in environment: interesting work experiences and a handful of IT industry certifications that were provided for me at no cost.

<comment><AUTHOR> Hmm, that's interesting. I guess the environment issue isn't black and white.

I guess what bothers me about all the people aiming for their government jobs is the fact that they're content doing menial maintenance of legacy systems in COBOL or whatever the hell they're written in. I know there's probably some brilliant kids in the program, and it seems like they're all convinced that it's the best/only path available to them, and they're fine with that.

</comment></comment><comment><USER4> You have to approach this drawing a distinction between learning a skill and joining a community.

If you joined this community college program in Ottawa to learn a trick or two about programming, you approached it with the right mindset. You approached it looking for technical improvement.

It sounds like, however, you joined the program looking for rock stars. If Ottawa was a technology startup focused town, you'd know it already - <USER2> would be technology startups. Environment is so critical.

I come from another government town (Washington, DC) and there are a significant number of absolutely brilliant people here...who want nothing to do with a tech startup. They're government employees, or contractors, or even just policy wonks. That's not a slight against their intelligence; it's just that the culture in DC is not geared toward startups while Silicon Valley is.

There's not going to be an easy way or good time to rip yourself away from Ottawa - it's going to be frustrating and probably won't be an easy move. But if that's what you want to do, you'll have to find a way.

</comment><comment><USER5> _Am I just in the wrong program at the wrong school at the wrong time?_

Yes. Maybe the wrong program, definitely the wrong school. (You have little choice about the time, so forget about it.)

Suggestion: Be the person you want to meet. The only person you can control is yourself, and even that ain't easy. The other students are idiots right now? Well, give them a chance to learn.

The rest is just a chaotic process; maybe you meet people that you click with, maybe you don't, maybe it comes easily, maybe it doesn't. If you get lucky, it probably won't come from a direction you expected, so stay open to all the opportunities you can find. Do what you can to improve your odds, in the meantime.

<comment><AUTHOR> This is great advice. I'm generally fairly introverted, so this is something I could put some effort in to and hopefully get some results.

One thing I need to make more of an effort in is to meet people outside of school. I should, and will, look in to some local meetups and things of that nature to meet people.

Thanks a lot for reading and commenting!

<comment><USER6> Don't be afraid to venture outside of student groups either.

Most areas have user groups of various sorts. Don't be afraid to attend user groups for technologies you're not necessarily interested in right now.

Good geeks often have broad interests. You'll be surprised at the number of .Net developers at a user group meeting who also hack Ruby and Python, and know their way around a Unix command line.

</comment></comment></comment><comment><USER7> I encountered these types of students when I was at university, as well. From what I hear, they're common at most universities. It seems like the vast majority of people going into Computer Science choose it because they want to write video games or make web sites, not because they're genuinely interested in Computer Science. Many schools have been downgrading their programs to cater to them (after all, their money is just as <insert color of legal tender here>).

<comment><AUTHOR> Thanks for the comment and for reading; it's good to know I'm not alone.

How did you deal with it? Did you actively seek out like-minded people? If so, any tips on how I can do the same?

Thanks again.

<comment><USER7> Honestly, I was absolutely miserable for the first two years. Eventually I met a couple of really awesome friends. The only advice I can really give is not to write anyone off without first giving them a chance: some of the coolest people will be the ones you least suspect.

<comment><USER8> As a fellow CS Grad, my one little piece of advice is to just give it some time. You've got a weed-out course coming somewhere after your intro classes, and those left will be the ones that are really dedicated and have the tools to press onward.

</comment></comment></comment></comment><comment><USER9> Not speaking from personal experience, but the difference between the kids who go to a community college and a school with a respected <insert field here> program is going to be massive. I'd be figuring out how to transfer to somewhere better in a hurry. Even if it takes you time to save up money or whatever.

<comment><AUTHOR> That's my problem (and goal) right now: money.

I figured the gap would be quite large, so my goal now is to graduate from the two year program I'm in now, so that I have at least something under my belt, and then move on to bigger and better things at a bigger and better school.

Thanks a lot for the comment and advice!

<comment><USER10> Hey, I don't know a thing about you, but I'm going to take your post on face value, which makes it _sound_ like you got half a clue, and some ambition, and a year of dev work experience.

Let's talk about money.

Algonquin's tuition is what, $1,212.20 per 13-week semester? I'm hoping that's for 15+ hours per week of classroom time (a.k.a 5 3-credit courses), counting only time with a faculty member, not TAs. Plus some bonus lab/TA time, maybe, depending. Based on a little website, let's look at a few Real Schools (a few in your city, a few in mine). UOttawa says they charge $2,710.65 for Fall 2011 (again, presumably for 15 hours of classroom time a week, plus labs). Carleton astonished me at $6k+, that's freaky high (PS you US people, I'm not talking about the U.S.). At my end of the country, SFU charges $163.80 per credit (i.e. multiply by 15 for a full load, getting $2500). UBC is marginally cheaper. None of those places is MIT or Waterloo, but at least UBC and SFU are _fine_ schools.

Last year, you were working as a junior dev with no edumacation, presumably no serious prior experience, but you know enough to ask "what distribution", so probably you're useful. Making what, gotta be more than $10k a semester pre- tax ($30k a year)? Gotta be at least that much, although I dunno what Ottawa rates are like. Can you do that job while going to school? Do you want to? Your real cost of going to school is that you lost access to that $10k-$15k for the semester. The difference between $1k tuition and $3k tuition just became kinda dinky, eh?

The point is, the difference in tuition between Algonquin and UOttawa should be ignorable. You've already forfeited $10k+ in salary, and $1k in tuition, PER SEMESTER, so $1k extra is kinda icing on the cake. Optimize correctly! Don't waste your life at the wrong school over such a small difference! (I admit Carleton's apparently $6k makes me hesitate a little).

Now, teaching quality.

Teaching quality MIGHT be great at a college, I can't say. I went to Capilano College (now University) for 2 years, and I got some really really great instructors. But if that's not what you're getting, why are you wasting money, and more importantly time? Bad GPA you need to fix?

And listen, if the program has great teaching (not that you'd know at two weeks in), then it'll be a viable foundation to build on at a bigger/better school. But if you're getting half-assed teaching, then you're wasting time, not getting something under your belt. (If they teach badly but you already know it, you're wasting time. If you don't know it now and they don't teach it, wasting time!)

And now to your original point about peers. Yeah, a community college is gonna attract a lot of marginal students. I met a few awesome and very smart people at Capilano College (smarter than me), but I gotta admit, they were a lot fewer and farther between than what I got to meet at SFU. Partly that's just the size of the pool of potential peers, partly it's that larger schools have better structures in place to help you FIND those peers (more societies, etc).

Half the point of going to school is to meet awesome peers who mutually inspire you, who you can have great experiences with, etc.

I guess what I'm saying is, if the kids are driving you batshit, you should see how fast you can get your ass into a better group of kids. Of course, the problem could just be you. ;)

</comment></comment></comment><comment><USER11> What level of class is it?

If it is an introductory class just be happy that people are there. I know plenty of programmers (including myself) who only got interested in CS because of video games. I then figured out I liked CS and didn't really like making games.

<comment><AUTHOR> This program is as entry-level as it gets. No prerequisites, two years, assumes no prior knowledge.

It's weak, but it's the best I could afford.</comment></comment>