The way people copy each other's linguistic style reveals their pecking order - <AUTHOR> http://www.technologyreview.com/blog/arxiv/27437/#.TwCoUmRdUnU.twitter

<comment><USER2> I found the following somewhat funny given that this article discusses pecking orders and linguistic choices:

This was submitted 2 weeks ago [1], with the title "Computer Scientists Create Algorithm That Measures Human Pecking Order", which is appended to the main title for the article. (reached 48 points)

pg has resubmitted this 2 weeks later, using the subtitle of the article, "The way people copy each other's linguistic style reveals their pecking order." (so far 96 points)

Now I'm not nitpicking about credit, I don't care. My question is to what degree is this submission getting more traction from pg's status, and to what degree is it getting more traction due to the linguistic choice of a more specific, better(?) title?

I'd say pg, at least here on HN, is higher up in the pecking order than the person who submitted the article first (llambda).

On the other hand, the subtitle is certainly more descriptive, since computer scientists have been making algorithms to measure human pecking orders for a while, with large companies seeking to build brand confidence by giving away their products to "influential individuals", etc.

This is different than the effect described in the article. The original article contrasts their new work with previous approaches that focus on structural/network effects: who's talking to whom, etc.

I guess what spiked my interest is that your power and/or reputation still affect the linguistic choice of whether to respond at all.

[1] <http://news.ycombinator.com/item?id=3385517>

<comment><USER3> The earlier submission appears to be from Christmas Eve, when the entire world was on a weekend and most English-speaking countries were either _on_ a major holiday or preparing for its imminent arrival. This submission was late on New Years Day in the USA, at a time when much of the world was already halfway through Monday, January 2. (I believe this was submitted at noon on Monday Sydney time, for example.)

That's just one of many alternative hypotheses to explain the difference in traffic. Obviously, there's also a raft of "competitive" hypotheses: Articles on HN don't sink or swim in a vacuum, they have to compete with the other articles on the site at any given moment.

</comment></comment><comment><USER4> When I talk to people who have language problems (I was a TA at a US university, so I meet a diverse set of language skill levels in my students), I notice that I sometimes copy the amount of broken-ness in their language (involuntarily). This is not in a condescending way, because I can sense they become comfortable at once. To understand this in a different way, try to imagine one person speaking broken English and the other person just completely keeping up his fast fluent pace in all his replies. That would seem pretty rude.

What I wanted to get at is this, pecking order might not be the only reason to copy verbal styles. Empathy might be one more reason. Does this study control for this?

<comment><USER5> I am Spanish and my English is good but not perfect. Any way when I find myself talking English close to people who´s English is worst than mine, I change my pronunciation to one much less accurate (almost Spanish pronunciation of English words). I just don´t feel confortable pronouncing properly (well kind off properly) in that situation, I just hide my ability. (maybe to avoid the mythical Spanish envy?).

<comment><USER6> It's also a lot easier to understand. I am constantly asking my German colleagues to pronounce that word 'as if they were imitating my accent', so I can get some idea of the spelling, and not just a smudge of weird consonants.

<comment><USER7> I cannot actually speak German, but isn't German relation of pronunciation to spelling much clearer than in English (for which it's notoriously intractable, see the famous "ghoti" joke)?

<comment><USER6> Yes, it's phairly phonetic, but there are a few different 'h', 'ch', and 'k' sounds that were initially completely undistinguishable to my ears.

</comment></comment></comment></comment></comment><comment><USER8> It would be fascinating to analyze this in verbal communication. I've thought about this in the past, specifically in how idiomatic expressions, "inside jokes" and the like are disseminated through social groups. It always seems that certain individuals in a group are responsible for setting the tone and style of humor and colloquial expression, while the rest end up mimicing the leaders.

In a more practical sense, simply being able to recognize these signals would be very valuable in meetings, especially sales meetings involving pitching a group when it is unclear who the actual decision makers are.

<comment><USER9> The article mostly talks about structural words. The real breakthrough is that they provide a lot of clues into our very being. We can predict lying, age, gender, and power using them. For those interested in this it would be worth checking out The Secret Life of Pronouns[1]

Your second paragraph talks about being able to notice these things in meetings. Penbrooke's research[1] shows that our brains ignore structural words. So it's pretty impossible to take advantage of this particular research.

However, I think there are a few things you can do.

1\. You're first paragraph about "inside jokes" is spot on. When I was in college it was pretty common to to get what were called "Dorm Floor" shirts. The front had some slogan or name on them and the back had quotes from your dorm floor. When we went to create ours there were three of us who dominated the floor quotes. So they made a limit for how many quotes a person could have. Most of these quotes were essentially inside jokes.

If you want to know where you stand in a group it's pretty easy to test this using inside jokes. Can you start something? If they respect you they will pick up your inside joke.

2.When I was in college, I took a lot of discussion based classes related to political theory. I noticed my self picking up the mannerisms of a kid in my class. I then realized that others were too. This was a huge eye opening experience for me. I realized that mannerism and the way we speak is organic and if we can record it's evolution it tells us something about how power and society works.

The down side of this is that in a meeting you don't see the birth of the mannerism so you don't know who the decision makers are. You also can't mentally process the structural words, so I don't think there's much advantage there.

[1]<http://secretlifeofpronouns.com/>

<comment><USER10> I have noticed the copying of mannerisms as well in college. I didn't know about all this research.

But then I decided to play along and started to pick professors and copy their mannerisms and verbal style on purpose. So on week I would talk and act like a math professor, then like the physics one. I didn't do it in an overt, derogatory, or offensive, but in a subtle way. Doubt anyone even noticed. It was interesting that it was easier to copy from those that I respected and looked up to. some that I didn't care about just came harder to do.

</comment></comment></comment><comment><USER11> James Pennebaker wrote about this in "The Secret Life of Pronouns". It was a good book released late last year.

He also does twitter stream analysis using his research and you can find that here --> <http://analyzewords.com>

People might dismiss it as tripe, but after you've read some of his assertions and look over your own emails you'll probably believe it makes a bit of sense.

<comment><USER12> I thought Pennebaker found an absolute correlation between status and pronoun usage (e.g. higher-status uses "we" more than lower-status), where this work seems to be about relative patterns between individuals.

<comment><USER11> He didn't really have a definite pattern for higher status except they used more articles, however lower status used more "I"s.

Yet later in the book he also mentioned mirrored language and who reflects who. He also had some sort of web program that measured the difference between the two. I think that correlates with the goals of this study.

</comment></comment></comment><comment><USER13> Direct link to the paper: <http://arxiv.org/pdf/1112.3670v1>

</comment><comment><USER14> It's interesting that linguistic co-ordination is being used to determine "pecking order". Maybe so, but I observe things a bit differently.

I grew up in a part of the country that was mostly rural, toward the midwest/southeast part of the US. I was raised believing that "y'all" was a label for referencing a group of people.

I no longer live in this part of the country, but return from time to time for family. Re-connecting with family and friends, my wife will notice that I start to sound like everyone with whom we're surrounded (she kindly refers to this as my "inner hick".)

If this is true (I assume it is), it is completely sub-conscious. If there is anything I'm consciously doing, it is attempting to bridge any perceived gap in communication.

In terms of pecking order, it may be the case that I'm conforming to my surroundings. I tend to think of it more as "when in Rome".

I don't care for the value judgment implied by the term "pecking order", as it denotes that someone is in control or holds more influence. Communication carries an underlying intent, a reason for the communication to occur in the first place. Linguistic analysis can measure syntax and output, but it doesn't measure intent. And intent is important to understanding the value of communication.

When the Google guys came up with PageRank, the assumption was that the intent of including a link was to point to a more credible source. As we now know, assuming the intent of a website to link to another as a means of assessing credibility is flawed.

</comment><comment><USER15> Very interesting. At first blush (based on the title and first bit of the article) I wanted to offer an alternative explanation, something like:

1\. People make sense of things through language. (You can get this sentiment in sound-bite form from any number of linguists or language philosophers, e.g. Wittgenstein's "The limits of my language mean the limits of my world.")

2\. People with more linguistic resources are better able to make sense of things, and thus tend to rise to the top of the pecking order. (N.B.: Language is more than just words, so this isn't simply an issue of vocabulary.)

3\. People with fewer linguistic resources are drawn to the expressions of people with more linguistic resources because those expressions give them new ways to make sense of things. They're like design patterns for thought.

4\. Thus, what's being measured isn't power or influence, at least not directly.

But of course _none of this is relevant to the article_ , which draws its conclusions from the degree of periphrasis in a discussion, rather than the substance of what is said. So, again, very interesting.

<comment><USER16> _4\. Thus, what's being measured isn't power or influence, at least not directly._

I'm with you until this because it doesn't seem to draw from points 1-3.

<comment><USER15> Yeah, that could be clearer. What initially struck me, before I'd finished reading the article, was the impending sense of post hoc ergo propter hoc. So my response, at that point, was to invert the relationship between copying and pecking order: a) "pecking order is an effect of copying" vs. b) "copying is an effect of pecking order."

If b) is the case then it makes sense to frame the issue as "The way people copy each other's linguistic style reveals their pecking order." But if a) is the case then the article's conclusion is tautological. Of course you're right that that doesn't stop us from taking it as a direct measure of power or influence, since they're still strongly correlated. I was just thinking of it more as a measure of linguistic reserves [1].

[1] <http://goo.gl/NOUwo> (Sorry to use a link shortener, but it's a long Google Books URL.)

<comment><USER17> [http://books.google.com.hk/books?id=6Buf_AlaadwC&lpg=PA3...](http://books.google.com.hk/books?id=6Buf_AlaadwC&lpg=PA32&ots=OTaAn2AT6c&dq=%22linguistic+reserves%22&pg=PA31&redir_esc=y#v=onepage&q=%22in%20parallel%20with%20kafka%22&f=false)

HN shortens automatically...

</comment></comment></comment></comment><comment><USER18> It's interesting, I would have thought something different. I'd have thought that people who are more capable of adapting to the communication style of their peers had a subtle advantage (though that may not reveal pecking order).

I've always thought of a person that can hold a high level, technical conversation one moment, then adjust their vocabulary and speaking style to communicate with some neighborhood children the next, then adopt a pidgin to communicate better when dealing with a non-native speaking friend, then switch to a local drawl when getting their car fixed by the local mechanic, to have a special sort of power w/r to communicating effectively with their audience.

People who don't seem capable of adjusting their patterns based on audience seem more..."brittle" somehow.

</comment><comment><USER19> I still think this is the major effect that makes it harder for adults to learn a foreign language. Brain chemistry changes a little between child and adult but your resistance to social inferiority signals changes a lot.

If you can reach a zen state of submission to the ocean of expression around you and follow the currents, you could learn like a child again. That's dang hard to do.

</comment><comment><USER20> While it is always nice to have harder proof than is usual in the humanities and to a lesser degree social sciences, I feel mildly irritated by the coverage which presents this as a "discovery" by clever tech people. These facts are pretty basic in sociolinguistics, the study of discourse, psychology of language etc., as amply acknowledged in the paper itself.

</comment><comment><USER21> And linguistic style reflects how a person thinks (so the theory goes). So when you mimic someone's linguistic style, you may find yourself succumbing to their way of thinking.

The theory continues that different programming languages reflect different linguistic styles and thus your choice of programming language can affect the way you think.

As an example, I do a large amount of text processing work using sed. Interestingly (imo), sed is a language designed by someone who had a degree in Psychology.

As a result, to some extent my way of thinking would probably differ from someone who uses, e.g., Perl as their preferred language for processing text.

<comment><USER22> Or vice-versa, i.e., one's thinking style affects one's choice of programming language. I believe this is why some programming languages just never clicked with me. My brain definitely resisted Perl...at first....

<comment><USER21> No doubt. But would you agree that the more you use someone else's language, the more your thinking adapts to their way of thinking, as evidenced in how they designed the language?

</comment></comment></comment><comment><USER23> I've actually observed this many times, having lived for quite some time in America and now quite some time in India - not just with linguistic style but also with accent (when the people talking to each other cross geographic boundaries).

So over the years, I've internally made a (somewhat silly) point to be aware of this and _not_ try and change the way I speak based on whom I'm speaking too.

</comment><comment><USER24> I'd be curious to know how much of this applies to non-native English speakers. I guess their native language can shape the way they build sentences and influence the way they communicate in different way. Or, maybe, they just attempt to correlate more with native English speakers.

</comment><comment><USER12> What kind of status are we talking here? Social standing? Authority role? Charisma? Persuasion?

</comment><comment><USER25> ah, that explains why both my manager, his manager and the team's group manager keep making the "... is is that" mistake. I'm a poor ESL guy, and my grammar parsing brain paths get fizzed whenever I hear them speak like that.

</comment><comment><USER26> Quite noticeable in politics. The mannerisms and speaking style of political leaders are quickly picked up by their followers.

When Kevin Rudd was the Australian Prime Minister, every Labor MP sprinkled their conversations with "can I just say" and asked themselves questions.

Now it's Julia Gillard and we're being treated to being spoken to like a class of special-needs 5 year olds.

</comment><comment><USER27> Quick question: does anyone know whether it's only true for English?

</comment><comment><USER28> Can someone please explain the chart?

<comment><USER2> Go read the original paper. The link is at the bottom, and it's a preprint on the Arxiv so it's not behind a paywall.</comment></comment>


It's not just the US: Around the world, doors are shutting on Chinese investment - <AUTHOR> https://www.politico.com/story/2018/09/13/china-us-investment-788834 <comment><USER2> _The U.S. has always subjected foreign acquisitions in sensitive industries to tough review. But the present administration has taken it to a new level and made it a focus in its disputes against China's trade practices._

Maybe it's an illusion, but, it seems as if, though most US allies dislike and resent Trump, they're following his lead in this particular policy area.

Maybe these nations think that, despite Trump's crazy bluster, the US knows something they don't.</comment>


Spring vs. Java EE and Why I Don't Care - <AUTHOR> http://jandiandme.blogspot.com/2010/10/spring-vs-java-ee-and-why-i-dont-care.html

<comment><AUTHOR> As a non-Java developer I thought this was an interesting insight in to how the Java community are responding to competition from dynamic language frameworks like Rails and Django.</comment>


Show HN: Better, Cheaper Electric Car Auto Insurance for 2019 and Beyond - <AUTHOR> https://electrade.app <comment><AUTHOR> Hey HN! I made this with a friend after hearing one-too-many complaints about EV insurance (and despite Tesla about to announce their EV own program supposedly). Our other EV startup failed, and since my co-founder has an insurance background we decided to try and solve this ourselves. For more on the problem, see [https://electrade.app/why- electrade/](https://electrade.app/why-electrade/).

Thanks for your support!

</comment><comment><USER2> Seems to be US only.

<comment><AUTHOR> Ah yes! Sorry it is – just launched. What country are you interested in seeing?</comment></comment>


Ask HN: WordPress designers in NYC area? - <AUTHOR>

A webmaster I know is looking for a WordPress designer/studio in the NYC area and asked me for recommendations.
Which WP designers in NYC would you recommend?
Thanks <comment><USER2> Here's a guy I know in NYC who can do wordpress: <http://gregorygallagherdesign.com/></comment>


Google's CEO Defends Potential Return to China - <AUTHOR> https://www.wsj.com/amp/articles/googles-ceo-defends-potential-return-to-china-1539661027 <comment><USER2> Whatever Chinese people say, they use only their own products unless it's Apple.</comment>


Ask HN: YC Fellowship DD? - <AUTHOR> I have stumbled upon this article https://blog.ycombinator.com/yc-fellowship/ from July 2015 announcing the YC Fellowship and another one in January 2016 announcing the Fellowship V2 https://blog.ycombinator.com/fellowship-v2/<p>I was wondering if YC fellowship continues and if so what's DD? <comment><USER2> Fellowship was replaced with a free online course and mentoring. [https://www.startupschool.org/](https://www.startupschool.org/)</comment>


Ask HN: Is there any country that allows foreigner setup their company online? - <AUTHOR> Hello, I am living in South Korea and I am a foreigner. The procedures to setup a company in SK are quite complicated for me. I just want to have a legal entity to run my online business (SaaS), I would like to ask if there is any country that allows me to register a company online (with simple procedures). Thank you very much!
P/s: This question is inspired by this one: https://news.ycombinator.com/item?id=8870593
So thank the author ;)
I've heard a lot about some weird countries like: Luxembourg, British Virgin Islands.. where many paper  companies are made for different reasons (tax evasion, law...), so I think anyone can register a company there with ease? <comment><USER2> The UK limited allows that. There are many online services (law firms?) will help you for less than $100 USD. One of the first results I found [http://www.ltdcompany.co.uk/company-formation/starting-a- ltd...](http://www.ltdcompany.co.uk/company-formation/starting-a-ltd-company/)

<comment><USER3> You can easily set up a UK company online, but you won't be able to get a UK bank account.

However I was able to get my local bank to open an account for us when I presented stamped legal documents sent from the UK.

<comment><USER4> Could you provide more details on what was involved? Was your local bank a branch of a UK bank? Are you located within the EU? What legal documents did you need stamped? Who were they stamped by and how much did it cost?

<comment><USER3> I opened an account with www.lhv.ee - a bank in Estonia (EU), which is my home country.

We started a company, then ordered the incorporation documents, and then had them sent back to be apostilled. Then we forwarded them to the bank. I had also been in the bank office before to sign some paperwork and see what was possible.

Starting a company was 200£. Apostilling the document was 30£. The cost of opening the bank account was 500€. Add some postage fees.

Starting the company: [http://www.companiesmadesimple.com/page1512en.html?namesearc...](http://www.companiesmadesimple.com/page1512en.html?namesearch=no) Getting the certificate of incorporation from them mailed. Apostilling documents: [https://www.gov.uk/get-document-legalised](https://www.gov.uk/get- document-legalised) Bank we used: [https://www.lhv.ee/](https://www.lhv.ee/)

<comment><USER4> Thanks for all this. I suspect it is impossible to do outside of the eu.

</comment></comment></comment></comment></comment><comment><USER5> Estonia is trying to make this possible with their e-Estonia initiative [https://e-estonia.com/component/e-business- register/](https://e-estonia.com/component/e-business-register/)

<comment><USER6> The way it was explained to me is that you need to physically travel to Estonia once, to become an Estonian e-resident. From then on, you can deal with the Estonian government exclusively via the internet. You get access to a very large amount of the services they provide to their real citizens. Not all, of course, but starting a business is on the list.

<comment><USER7> Currently, yes, you need to travel to Estonia: [https://e-estonia.com/e-residents/apply-2/](https://e-estonia.com/e-residents/apply-2/) ... but from mid-year it should be possible to become an e-resident via an application to an Estonian consulate without needing to travel to Estonia itself.

</comment></comment></comment><comment><USER8> In the UK you can do it via Companies House for £15: [https://ewf.companieshouse.gov.uk/runpage?page=welcome](https://ewf.companieshouse.gov.uk/runpage?page=welcome)

Edit: Not sure about for foreigners though.

<comment><USER9> Yes, you can, both EU residents and out of EU residents.

But you need an official address in UK (registered address) for your company, where Government can send you official mail. There are companies that give you this service, so it's not a big problem.

<comment><AUTHOR> "There are companies that give you this service, so it's not a big problem.", can you list some companies who provide this kind of service?

<comment><USER10> I registered my UK company while I was living in Germany. I used these guys for my registered company address: [https://www.smallfirmsservices.com/Default.aspx](https://www.smallfirmsservices.com/Default.aspx)

I used their cheapest service (£80/year) for which you get the company address, and they will only forward mail from HMRC and Companies House - anything else gets returned to sender.

We still use them, even though we have a trading address now.

<comment><USER11> How easy it was to get a bank account?

<comment><USER10> It was ok for me as I already had a UK domestic account and a UK address I could use, but I think from outside the UK this would be very difficult. I suspect your best bet would be HSBC as they operate an "international" model (supposedly).

</comment></comment></comment></comment></comment></comment><comment><USER12> Read this fantastic blog ....matches your situation : it gives you info about everything (how to incorporate in USA, Physical address, Opening a bank account, cost etc.) .... GOOD LUCK!

[http://blog.freshdesk.com/how-to-incorporate-a-us- corporatio...](http://blog.freshdesk.com/how-to-incorporate-a-us-corporation- from-outs/)

</comment><comment><USER13> You are asking about setting up the company, but you will want to consider other factors as well:

\- Where can you open a bank account for the company?

\- What are the annual and periodic filing requirements (and fees) in regards to ongoing company registration (e.g. the Company Annual Return in the UK)?

\- What are the tax filing requirements and tax rates for your situation?

\- Do you annual company accounts need to be filed? Do these accounts need to be audited by a professional accountancy firm? Are there any exemptions from this requirement?

\- What are your own country's laws re: determining the domicile of a corporate entity, for the purposes of calculating tax?

</comment><comment><USER14> I believe you can set up a company in Hong Kong online as a foreigner. Additionally, I believe that there is no corporate tax for Hong Kong companies that have no business presence or operations within Hong Kong.

<comment><AUTHOR> Does that mean I don't have to flight to Hong Kong and file application there? All I need to do is submit some documents online? It would be nice if you can give some more information (ex: website, etc..)

<comment><USER14> I'm afraid I'm totally unqualified to give any more information than can be found by searching the web.

It looks like you can do everything online and most applications are processed within one hour [1]. The minimum cost for a one-year registration looks like it's around 600 USD equivalent. My source for the statement about corporation tax is from PWC [2].

[1] [http://www.investhk.gov.hk/setting-up-your-business/hong- kon...](http://www.investhk.gov.hk/setting-up-your-business/hong-kong-company- incorporation.html)

[2] [http://www.pwchk.com/home/eng/tax_hk_corptax.html](http://www.pwchk.com/home/eng/tax_hk_corptax.html)

</comment></comment></comment><comment><USER15> I don't know SK law.. but would this really simplify things? Does SK allow foreign corporations to operate in SK without any paperwork? Seems unlikely.

<comment><AUTHOR> My business is a SaaS company so basically I can provide service globally, not necessarily just in SK.

<comment><AUTHOR> @rgbrenner: Thank you but I am a student and study visa is not qualified for setting up a company. Otherwise, you have to invest ~100,000 USD to get a business visa then you can setup your company OR you have to spend time working in SK, gain some point from other activities (Korean language, community service..) to be qualified for a F2 visa (which is eligible for setting up a company). In my opinion, a very complicated system for foreigners who want to do business in SK.

<comment><USER16> Where are you from? One option could be to incorporate a company, and appoint your mother or father as a director.

Not completely legal, but if you're testing a market (and not making any money) I doubt anyone will care.

I think that's a much 'safer' way than setting up a company in some obscure jurisdiction (e.g. Estonia, Lux) where you don't speak the language.

</comment></comment></comment></comment><comment><USER17> You also need to make sure that having a foreign company will meet your requirements for why you want to have a limited company, under local law.

</comment><comment><USER18> Starting the company in the US is actually the easy part; getting a bank account and/or merchant account can add complications. We've created a checklist here: [http://www.mynewcompany.com/international.htm](http://www.mynewcompany.com/international.htm)

</comment><comment><USER4> It is relatively easy to set up a company online in many countries, the difficulty is opening a bank account.

</comment><comment><USER19> UK, Isle of Man or Estonia.

</comment><comment><USER20> Can I register my startup in UK without even going there with just £15. This sounds interesting but are there any complications or hidden stuffs that I should be aware of?

</comment><comment><USER21> Our UK Ltd was registered in a day by evabookkeeping.co.uk after we've sent the documents, and we don't have anybody in our company living in UK.

</comment><comment><USER22> I bookmarked this the other day. Check it out...

[http://www.1click2startacompany.com/](http://www.1click2startacompany.com/)

</comment><comment><USER23> Ireland does allow [https://core.cro.ie/Main/index.jsp](https://core.cro.ie/Main/index.jsp)

</comment><comment><USER24> Why do you need the company???

</comment><comment><USER25> Are you American? Have you tried contacting someone at the u.s. Chamber of commerce in South Korea?

<comment><AUTHOR> No, I am not.</comment></comment>


Activision Blizzard lays off nearly 800 employees after 'record' 2018 - <AUTHOR> https://www.engadget.com/2019/02/12/activision-blizzard-layoffs-800-employees-record-2018/ <comment><USER2> _" While our financial results for 2018 were the best in our history, we didn't realize our full potential," Kotick said in Activision's 2018 financial report. "To help us reach our full potential, we have made a number of important leadership changes. These changes should enable us to achieve the many opportunities our industry affords us."_

wtf does that even mean?</comment>


A Patent On…. The SCRIPT tag - <AUTHOR> http://ajaxian.com/archives/a-patent-on-the-script-tag

<comment><USER2> Phew... good thing I use the lowercase version.</comment>


Developing 10x Faster with a Surface Go, Thanks to vs. Code and Azure - <AUTHOR> https://dev.to/azure/developing-10x-faster-with-a-surface-go-thanks-to-vs-code-and-azure-mho <comment><USER2> Or instead of spending $500 on the slow as mud Surface Go, you could spend $680 on a Dell with a Core i3...

[https://deals.dell.com/en-us/productdetail/2hfm](https://deals.dell.com/en- us/productdetail/2hfm)</comment>


Unfixable Google Pixel 2 XL - <AUTHOR> https://www.theverge.com/2017/10/24/16519530/google-pixel-2xl-screen-issues-deep-and-unfixable <comment><AUTHOR> Yet another failure at Google, is this the end of the Pixel line?

<comment><USER2> I own an original Pixel XL, it's an amazing phone. The Pixel line is just getting started.</comment></comment>


Steve Jobs D8 Full Interview on iTunes download - <AUTHOR> http://digitaldaily.allthingsd.com/20100617/steve-jobs-d8-interview-on-itunes/ <comment><USER2> or here.... if you don't want to go through itunes - [http://video.allthingsd.com/video/d8-steve-jobs-onstage- full...](http://video.allthingsd.com/video/d8-steve-jobs-onstage-full-length- video/70F7CC1D-FFBF-4BE0-BFF1-08C300E31E11)</comment>


Firefox fixes save gigabytes of memory on image-heavy pages - <AUTHOR> https://blog.mozilla.org/nnethercote/2013/10/01/memshrink-progress-week-117-120/ <comment><USER2> I just compared it with Chrome using the example page mentioned in article:

In Firefox Nightly at the initial page load it uses around 250 MB memory and with scrolling it stays around that.

In Chrome (in Canary too) initial it uses around 300 MB but scrolling keeps filling the memory indefinitely (I stopped scrolling above 1.2GB)

<comment><USER3> Yea, I also noticed that, save for the pages with tons of images, firefox has actually been better than chrome in that respect for the last few releases. Now with this fix, I'm seriously thinking of jumping back. Then I'll finally have my sweet DownThemAll again. Many kudos to the firefox devs, performance and memory-usage is very important, and it seems they realized that before it was too late. Even with my 16GB I'd really like to run an extra VM for development as opposed to letting my browser gobble it all up.

<comment><USER4> Last I tried Firefox, pretty recently, it still needed to address some serious issues, when compared to Chrome:

* Unresponsiveness due to one tab thrashing

* Bad use of screen-space (bookmarks always visible, cannot disappear titlebar like in Chrome [there's only a Windows extension for that], menu-bar takes up another bar of space by default)

* Launching firefox has stop-the-world behavior to check/update extensions -- interrupting your flow when you need your browser most

* Some extensions still require restarts

These are the ones I remember off the top of my mind, I'm sure there were more...

I really tried going back to Firefox, but the cumulative pain of all of these made me go back to Chrome.

<comment><USER5> Firefox's UI is the most customizable of any browser that I know of. You can really make it into almost anything you want. My example: [http://i.imgur.com/aMgQBgW.png](http://i.imgur.com/aMgQBgW.png) very clean and functional.

<comment><USER4> I couldn't find any customization that removed window decorations in Linux. I found ones for Windows only.

Also, I got the (subjective) feeling that Firefox was becoming sluggish as I had 6-7 addons. I might be wrong, but that would mean Firefox is sluggish in general.

<comment><USER6> If you can't do it through extensions, you may be able to remove window decorations using the window manager. The configuration is dependent on the specific window manager that you are using, but it should be possible.

<comment><USER4> In Chrome it Just Works...

Firefox has had years to catch up to Chrome with these issues, why haven't they?

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Great news! Many thanks to Timothy Nikkel and all the other Mozilla devs. It's particularly great on Fennec, where the memory constraint is noticeable.

For people - like me - who didn't know what B2G was, it's Boot2Gecko, the OS project: [https://wiki.mozilla.org/B2G/FAQ](https://wiki.mozilla.org/B2G/FAQ)

<comment><USER8> Check out [http://firefox.com/os](http://firefox.com/os) for a user view of Firefox OS and [https://developer.mozilla.org/en- US/docs/Mozilla/Firefox_OS](https://developer.mozilla.org/en- US/docs/Mozilla/Firefox_OS) for a Developer view.

</comment></comment><comment><USER9> Like many of the other Firefox memory changes, this one leaves me feeling a little ambiguous. On the one hand, obviously keeping memory usage down is good. On the other hand, waiting to decompress/decode images until they are visible to the user means that there are obviously going to be performance trade-offs (and also, obviously, design/engineering trade-offs).

Speaking just from my personal usage: I don't think there has ever been a time where delaying the image decompression on a page would ever have had any utility for me (at least from a memory standpoint). On the other hand, there have been plenty of times when eagerly performing image decompression would make my browsing a bit smoother.

All in all, it seems (from a not-particularly-in-touch outsider perspective) as if Mozilla went from being totally dismissive of memory complaints to being hyper-responsive to memory complaints with no (publicly stated) rationale behind the change. It would be interesting to see the reasoning behind this (if only from an intellectual standpoint), particularly given that in many cases I tend to feel that it would have been better to simply be a bit more diplomatic when rejecting memory-based bug reports.

<comment><USER10> If image decoding is asynchronous (don't know - guessing it is already?) and you decode them when they get near to the viewport and not just when they become visible, then it should always be decoded by the time you scroll to it and yet never jank the page. Scrolling a long way really fast probably means there's a small delay while it decodes images, but surely that's worth it to save gigabytes of memory?

<comment><USER9> > but surely that's worth it to save gigabytes of memory

I'm not sure _save_ is the right word here...using available memory has no particular cost to me over not using it. Of course, the _available_ modifier is relevant, so I take your point.

<comment><USER11> It's a huge advance for those of us who usually have 50-60 tabs open for weeks at a time, where hitting a really heavy image page would tip Firefox over the top and crash it.

I switched from Chrome to Firefox a couple of months ago for its ability to handle more tabs without slowing/crashing, and for its better performance with image-heavy pages. So, for me, it's not just "who cares?" it's a killer feature.

<comment><USER12> Tabs are not bookmarks. Use bookmarks.

<comment><USER13> Why should one use bookmarks rather than many tabs? I have many concurrent projects going, and things I refer to regularly, so I just leave them grouped in my tree of tabs on the sidebar. Much more efficient than digging through nested bookmark menus, or trying to make sure the bookmarks are properly classified.

Basically, my tabs are bookmarks, except tabs are integrated into the web- browser better.

<comment><USER14> So, the problem is that the bookmark UI design is broken.

<comment><USER13> My bookmark UI isn't broken: putting tree-style tabs in a sidebar is perfect.

<comment><USER15> If they would make the tree-style tabs very aggressively swap to disk, or even discard state entirely and seamlessly become a bookmark that would reload when clicked _(perhaps this behavior could work only for white-listed domains, like wikipedia.org)_ , that would be perfect.

The main usability problem with bookmarks over tabs AFAIC is that the bookmark UI does not encourage pruning bookmarks, so most become stale over time.

Another idea I've been kicking around for a while is "tab decay". Have tabs start to decay and close themselves after not being viewed for a configurable amount of time. 1 month would probably do it for me, it would save me a lot of cleanup time.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> I wish people would use regular 2d plots for 2d data.

Other than that, great news!

<comment><USER17> Technically it's 3D data, with the three axes being {Time, Memory Usage, Version}.

But I agree there may be a better way of visualising this data.

<comment><USER18> Technically it's three trials of 2D data, with the axes being Time and Memory Usage. The width of the lines given by the version axis is for visibility, not to encode data.

A 2D line graph with 3 colors for the different versions would be an appropriate visualization. This one suffers spatial distortion and is only useful in confirming that yes, they use less memory in step 2 now.

<comment><USER19> >The width of the lines given by the version axis is for visibility, not to encode data.

Bar graphs do exactly the same thing in a 2D graph. Would you suggest that all bar graphs be replaced by a one pixel wide stacked bar graph?

Of course not, because even though the samples in a bar graph are discrete, they convey order. It's the same here. The width of the lines is only for visibility, but the Z position of the lines conveys version order. A 2D line graph would only convey that by labels. And if labels were as useful as visual position, we could just replace all graphs with lists of numbers.

I personally found this graph trivial to read and comprehend. The spacial distortion is canceled out by the fact that the differences we're looking at are very large, and the steps axis is spaced out sufficiently to line up the points visually.

My only complaint is that it shouldn't be a line graph, as the steps are not continuous.

<comment><USER18> I do agree that a style with discrete steps would also be appropriate.

To the other points, no, not all bar graphs do the same thing. Bar graph bars are often the width they are due to data binning, where the width has significance.

The graph _was_ trivial, but made less clear by the 3D isometric projection. the spatial distortion is reduced but not canceled out by the space.

3D pie charts share the same failure. Yes, as long as the tilt is slight, they are still mostly readable. But it will make "closer" wedges appear larger and "farther" wedges appear smaller. It's visual dishonesty and unnecessary.

Just because one can finagle understanding out of a visualization does not make it a good visualization.

</comment></comment></comment></comment></comment><comment><USER20> Is it time to switch back to Firefox from Chrome? I remember when I originally switched around Firefox 3.5.x Chrome was much leaner and faster. Has the pendulum finally swung back the other way?

<comment><USER21> I never saw a reason to switch to Chrome to begin with. Performance was acceptable for me, while other benefits always made Firefox more useful (privacy with encrypted Sync, better add-ons and etc.). And some time ago, Firefox clearly became a leader in performance as well.

All this "jumping to Chrome" was simply a hype thing IMHO, and I generally don't care about hype.

<comment><USER22> From a developer standpoint, the dev tools in Chrome far exceed those in Firefox. The nightly releases are just starting to compare.

<comment><USER21> I rarely use those. And there is also Firebug.

</comment></comment></comment></comment><comment><USER23> Good to see continuing improvements in the browser of the free and open net.

</comment><comment><USER24> Tried the page with Opera (12.xx) and it peaked at around +850MB and within seconds backed down to the initial value (+0MB). No change during scrolling. How is that possible? Does the browser hold bigger pool and just got rid of other stuff?

</comment><comment> chestnut-tree Completely unscientific test: if I load the following website in Firefox 24 (on Windows 8), the page scrolls very sluggishly (as it did in previous Firefox versions). The same page scrolls fine in Chrome. I don't know what is causing the difference. Is it the images? Or something else? For info, Firefox is my main web browser and I have never switched to Chrome (nor do I intend to).

Warning - the website is ridiculously image heavy (it's a gallery of Android app screenshots)

[http://androidniceties.tumblr.com/](http://androidniceties.tumblr.com/)

</comment><comment><USER25> Chrome is starting to be a nightmare to use, might have to go back to Firefox.

I can't get meaningful help if it freezes or doesn't load and it can't deal with 50% of the router pages, IE only :(

</comment><comment><USER26> Sounds great - does anyone know how this compares to Chrome (both in terms of approach and results)?

<comment><USER27> As spyder says in another thread of this post, on the given page ([http://congressoamericano.blogspot.fr/p/fotos-do- congresso-a...](http://congressoamericano.blogspot.fr/p/fotos-do-congresso- americano-iii.html)) Chrome decodes and decodes... the memory usage goes up and up. I was using 1.5GO of memory before closing it (and still far from having loaded everything).

<comment><USER28> Do you know if the tabs run in separate processes yet (like Chrome) or will a crash/memory leak/long running script cause the whole browser session to close?

<comment><USER29> They don't in Desktop firefox, they do in Android firefox

</comment></comment></comment></comment><comment><USER30> For those Complaining about Firefox Responsiveness. There are e10s Reboot ( Process Per Component or tab ) that they are working on. Generational GC, New Graphics Backend etc.

</comment><comment><USER31> I returned to Firefox (Aurora) a couple of months ago, but i am currently starting to inch towards chrome again.

While reduced memory usage is good, it doesn't help when has major problems handling multiple open tabs with flash player, has problems with javascript- heavy pages, and the firefox profiles STILL degrade in performance over time.

I really don't want to remake my FF profiles every 2 weeks just to avoid performance issues.

<comment><USER32> What Firefox add-ons are you using? You shouldn't need to rebuild your profile every two weeks. How much does rebuilding your profile improve performance?

</comment></comment><comment><USER33> > When loading the page, physical memory consumption would still jump to > almost 3 GB, because the images are still decoded. But it would soon drop > down to a few hundred MB, as the decoded data for non-visible images was > discarded, and stay there (with some minor variations) while scrolling > around the page.

This is a great news. The application that uses the most memory on my machine is the web browser.

I wonder if this fix would make scrolling the page less smooth.

<comment><USER34> > I wonder if this fix would make scrolling the page less smooth.

It shouldn't. But why don't you try it?

</comment></comment><comment><USER35> Interestingly, this optimization is already unnecessary if you are using the common technique of setting the CSS background-image on an element rather than using IMG src - on Chrome, Firefox and even Internet Explorer memory usage will be stable on a grid of images that way and, as a bonus, you trivially get cross-browser scaling and centering for vertically scaling thumbnails to be the same size.

</comment><comment><USER36> Excellent news! This problem was so bad that after only a couple pages of porn gifs on Tumblr i had to open Chrome to keep the smut going.

</comment><comment> mark-r I switched to Chrome recently because Firefox was growing overnight to the point where it started thrashing and becoming unusable. I just checked and it says I already have the latest version. This recent change must not be the whole story.

<comment><USER37> The latest changes done as part of this are only present on Aurora (Firefox alpha) and the feature is turned off by default.

Also, I have my Firefox (Aurora again) running for over a week now on my dev machine with > 50 tabs open an I have had no issues with memory. I suppose there is some problem with one of your add-ons. Try creating a clean profile and see if it's any different.

</comment></comment><comment><USER38> If Firefox would find a way to let Chrome extensions work in Firefox, that would definitely make it a little easier to switch back and forth, definitely going to try this out though.

</comment><comment><USER39> Nice. This means that SeaMonkey will be getting these updates a day or two after FF.

</comment><comment><USER40> Or alternatively... Firefox fail was previously wasting gigabytes of memory on image-heavy pages

<comment><USER41> Gee, the trolls are up early today...

<comment><USER42> On one hand true, on the other - it isn't that those fixes are some magic, extra smart hackery (at least on the idea level, dunno about the implementation). Don't load an image that user don't see, remove an image that user saw but don't see anymore - those seem as rather obvious solutions.

<comment><USER28> The great thing about Firefox is that if something is so obvious, you could also contribute to the development effort...

<comment><USER43> right on. Please spend as much time reading the bug referenced above as you have this thread, and think about the obvious problems/hard solutions proposed, then make a better one! Just keeping a few million WinXP machines from a recycling barge in Bangladesh for another year would be worth the trouble. and hopefully smarter image handling by everybody's browser/phone/whatever will be a long term result.</comment></comment></comment></comment></comment>


Show HN: A proactive way of securing your Linux server - <AUTHOR> https://github.com/prashantgupta24/firewalld-rest <comment><USER2> This just feels like moving ssh auth to another port, using an obscure "authentication format" that nearly no one uses.

If you're using pubkey or certificate auth, have disabled password auth, and restrict what users are allowed to ssh in, this just feels like added complexity and points of failure (not to mention a possible source of crypto vulnerabilities) with not much added benefit.

Having said that, it's a cool project in general, and I feel like it could be useful to dynamically manage access to large groups of servers (perhaps not just ssh; you could use it to manage access to https interfaces or other things). Then again, if you have a large group of servers, you should have those ports blocked to the world and only allow access through a VPN and/or jump boxes.

<comment><USER3> Is there a practical benefit to pubkey or certificate auth? I feel like using ufw with limit on port 22 and using fail2ban covers most cases, assuming good password decisions.

<comment><USER4> Against a securely generated password in password manager? No. The only real advantage I can think of is ergonomics: you can safely reuse a public key/certificate across multiple hosts, and even if one of them becomes compromised, your key isn't.

<comment><USER5> This isn't true: because the secret never leaves your client machine, mitm attacks can't be trivially leveraged to access other systems you have access to.

<comment><USER4> Isn't that what I said? How are you going to get access to other machines if each machine has a unique password?

<comment><USER5> Sorry, missed that: the problem with a password is that, it the session is mitmed, your password is compromised and the person running the attack can login to the machine whenever they want. ssh keys prevent this attack: mitm only grants access for the duration of the session.

</comment></comment></comment></comment></comment></comment><comment><USER6> This is very similar to port knocking, although more complicated. Although a proper JWT token is "more secure" than a sequence of 0-65535 integers, I contend that having complicated and/or unvetted logic as your first line of defense is more problematic than secure.

<comment><USER7> Yeah, I'd want to see a mention of port-knocking in the README, indicating that the author was familiar with this technique, and the known critiques of it, and why they think this method (or port-knocking in general?) withstands it. Cause it's definitely in the vicinity.

With no mention, it makes me wonder if the author is familiar with the history of this approach, which is not a good sign.

And yeah, I'm skeptical. Is this new, uncommon/unvetted, and somewhat complex "access" app just another place for potential vulnerabilities that give someone the keys to the kingdom?

<comment><USER8> > With no mention, it makes me wonder if the author is familiar with the > history of this approach, which is not a good sign.

Seeing as the word "proactive" keeps reappearing in a similar fashion to "decentralized" does for people promoting their blockchain app (invariably hosted web app on google cloud or aws, using Ethereum nodes from Infura, and administered by a single permissioned smart contract) yeah, sounds like OP is excited they invented this new principle.

</comment></comment></comment><comment><USER9> Setting this up makes much less sense than setting up a tested vpn, such as wireguard or open, or even a persistent ssh tunnel using autossh to your home rpi.

I would never allow my prod systems to be potentially exposed by an api that runs as root. (And the documentation is incorrect on that; it should run as an unprivileged user with sudo privs to only run a wrapper script that runs firewall-cmd).

This also makes little sense in the context of configuration management, which should be enforcing a static set of iptables rules.

<comment><USER10> Personally I'd make a binary run as a non-root user with just CAP_NET_ADMIN and CAP_NET_RAW permissions to cut the scope down even more.

<comment><USER9> Having not used setcap, would that also require the setuid bit to be set with ownership as root (like sudo)? And reside on a filesystem without the nosuid mount option?

<comment><USER11> > would that also require the setuid bit to be set with ownership as root > (like sudo)?

Doesn't setuid just change to whichever user owns the file? So with setuid root only needs to own it if you want full administrative privileges.

I also haven't played with setcap myself. My understanding is that capabilities don't rely on file ownership but instead on extended file attributes (which can't be changed by ordinary users on a correctly configured system). So root doesn't need to own the file, but of course granting any capabilities to a binary for which a non-root user has write permission seems like it would be a really bad idea in general.

> And reside on a filesystem without the nosuid mount option?

Yes, it appears the nosuid mount option disables file capabilities. (As one would hope!) But I'm not really seeing how that's an issue since (for example) bind mounts and btrfs subvolume mounts both allow changing the nosuid option.

(man 7 capabilities)

> 1\. For all privileged operations, the kernel must check whether the thread > has the required capability in its effective set.

> 2\. The kernel must provide system calls allowing a thread's capability sets > to be changed and retrieved.

> 3\. The file system must support attaching capabilities to an executable > file, so that a process gains those capabilities when the file is executed.

([https://wiki.archlinux.org/index.php/Capabilities](https://wiki.archlinux.org/index.php/Capabilities))

> Capabilities are implemented on Linux using extended attributes (xattr(7)) > in the security namespace.

(man 2 execve)

> The capabilities of the program file (see capabilities(7)) are also ignored > if any of the above are true.

</comment></comment></comment></comment><comment><USER12> I like to run fail2ban in conjunction with a non-standard SSH port on which only public key auth is available.

This way, most of the junkware that does rude things to port 22 is banging on a closed door; the slightly more effective junkware that actually finds the SSH port gets banned immediately, because I know anyone trying to log in with a password is full of it.

<comment><USER13> Wouldn't it make more sense then to keep SSH on 22? Think of it like a honeypot. The more accessible you make it, the more bans you get. There was a guy on here saying that fail2ban banning SSH bruteforcers also reduced the number of HTTP bruteforcers, because they overlap.

<comment><USER14> This is a noob question, but could you not setup fail2ban to ban bad IPs on both ports, even if you're not using SSH on one? I'm wondering if it's possible to close port 22 and set fail2ban rules to ban any IPs that try to SSH there, while changing your SSH port and also setting up fail2ban on that port, too. Does a closed port work like that?

<comment><USER2> fail2ban works by tailing authentication logs and matching regexes to find failed attempts and the IP address of the source. So if nothing is listening on the port, there won't be anything to spit out logs that fail2ban can read.

You could potentially create a fake daemon that listens on port 22 and just logs every access attempt, and set up fail2ban to block any IP that even opens a connection to the port, regardless of what they try to send over it.

Actually, I think iptables has a LOG target that can log connection attempts even without something listening, so that could work too and be much simpler.

<comment><USER8> Just make sure to exclude that port from service checks ;)

</comment></comment></comment></comment></comment><comment><USER15> I usually just disable password auth and update regularly, when I have an SSH server open to the internet.

Short of an 0day in the SSH service, I expect brute forcing the private key(s) to take longer than I have years to live.

<comment><USER16> But it takes CPU, fills up log files, etc.

fail2ban is the first thing install. It's also easy to understand, which I love. It's basically regex on log files.

<comment><USER17> It really doesn't make that big a difference. I have single core, 515MiB VMs that idle at <1% utilization with background noise. Most distros come with logrotate anyways.

<comment><USER18> > Most distros

Most distros those days come with journald, and to best of my awareness journald does not have per-unit (or better, per unit per message type) configurable retention.

Still in the TODO list today: [https://github.com/systemd/systemd/blob/908dbc70d6abeb9f6562...](https://github.com/systemd/systemd/blob/908dbc70d6abeb9f65624d89fb5ca021815d69ae/TODO#L1037) (since at least 2016), with corresponding issue gathering no traction: [https://github.com/systemd/systemd/issues/9519](https://github.com/systemd/systemd/issues/9519)

<comment><USER19> Yes, but don't most of them _also_ come with syslog forwarding enabled and a syslogd (rsyslog, syslog-ng, etc.) and logrotate installed?

</comment></comment></comment></comment></comment><comment><USER20> The idea is better than port knocking, in the sense that you take active action to associate your host with the server, but there's a few issues.

* Something this simple shouldn't need k8s, unless it was intended as an exercise by the developer for that reason

* It combines the idea of using a non-standard port with certificate based authentication, which you can already do with SSH-- it's functionally the same with more steps

Hypothetically, this approach can be more powerful as a centralized service running elsewhere, (i.e. cloud, your remote DC) and used for a whole bunch of jump boxes and end-users. End-users could run a "check-in" script wrapping around SSH that notified the service that a user was imminent, and then could check the server to see if 1) The bearer token is accepted for the destination server 2) That the destination server checked in, saw the new incoming request, and has already opened the port -- And then proceeds to run the SSH command if all is well, or fails with appropriate error.

</comment><comment><USER21> Nope nope nope.

This has serious quality issues and any competent and nice sysadmin should say _nope_ to run this in any serious environment, for your own good ;-)

IP addresses are just strings? At least parse/validate for IPv4/IPv6.

Why yet another database? Can't the rules be loaded from the running system?

Why not just ipset-persistent + knockd + portsentry? I know it is easy to get overexcited with a new pet project, but just be careful to not put this kind of stuff in a production system kidos.

<comment><AUTHOR> Thank you for the feedback!

<comment><USER21> Anytime.

I saw you are already implementing some ideas from my inputs, that is great, please keep it going.

Eventually, in notorious systems, you may face issues of having too many /32 rules, a good idea is to implement some mechanism to defragment them into single/bigger contiguous cidr blocks. There are other firewall implementations that can serve as inspiration.

OR

I recommend using ipset with a single iptables rule to match/block from the set. This way you don't need to reload stuff everytime. (Just add the ips into the set)

PS: I hope you don't mind my snark comments, HN is fun.

<comment><AUTHOR> I do not mind at all. I appreciate constructive criticism. Plus you gave me points to work on, I really appreciate that. So much to learn!

</comment></comment></comment></comment><comment><USER22> I don't like this approach very much because it's much more complicated than it would have to be. Security is about layers, and this is essentially one layer that acts as the sole guardian for sshd.

The way that I like to do this is to have a common 'entry point' for all my cloud systems. Instead of whitelisting IPs on every VPS or cluster I build, I just add them to the ACL on my management server. All the other systems only allow SSH connections in from the bastion server. In practice, it works like this:

* Add IP to the whitelist file in my change control

* Run the Terraform script to update the DigitalOcean ACL

* Start an SSH agent locally and add the key for the bastion, as well as the key for the destination

* Connect to the destination server by using ProxyJump

So, connecting to a box would always route through my bastion system first, like this:

        ssh -J mgmt.mydomain.net cool-app-server.mydomain.net

I've been doing this for a couple years, and it works great. I practically never have attempted login attempts on my systems. And, since I use an ssh agent to forward the keys through the bastion without ever actually storing them, a compromise of that system doesn't really give the attacker anything other than access to port 22 on a bunch of systems that they wouldn't know where to find. Only the most sophisticated attack ([https://xkcd.com/538/](https://xkcd.com/538/)) would lead to a real compromise.

<comment><USER23> I love that XKCD, but this particular cartoon gives a false impression in order to be humorous. (You can't fault a comic artist for this of course.)

In my experience the #1 _real_ attack vector is the shouty middle manager demanding that: "Everything be opened right now because some outsourced admin says he needed it".

It's nigh impossible to use technological measures to defeat a CxO or a department head.

</comment></comment><comment><USER24> I like this "proactive" solution :) Endlessh: an SSH Tarpit [https://nullprogram.com/blog/2019/03/22/](https://nullprogram.com/blog/2019/03/22/)

</comment><comment><USER25> 6\. Possible enhancements

Rate limiting the number of requests that can be made to the application

So this just moves the brute forcing target from ssh to a web app. A lot of work for no added security.

</comment><comment><USER26> If I have public key authentication set up for ssh, should I even bother with fail2ban, firewalld-rest, port knocking, etc.? There's no way anyone is brute forcing my ed25519 key, so what's the point? Sure security should be layered and all that but it seems like public key auth is so strong by itself anything on top seems unnecessary.

<comment><USER27> It's very easy for brute-force attacks from botnets to consume all your SSH process slots and then you are locked out.

<comment><USER28> Can confirm, had this problem the other day. CI started failing and after a short investigation I figured out sshd was just dropping my connections. Installed fail2ban first, but then just used a firewall since all valid IPs are known.

</comment></comment></comment><comment><USER29> If you do not need the more granular firewall configuration options there is also classic port knocking ([https://en.wikipedia.org/wiki/Port_knocking](https://en.wikipedia.org/wiki/Port_knocking)) where the daemon sits behind the firewall so all ports can be closed by default.

</comment><comment><USER30> A dynamic IP filtering list is still reactive because you haven't actually secured the box or its services. You've just made it slightly inconvenient to brute force. You might as well use port knocking, because even with a fancy schmancy authentication system (and the attack surface of a custom web app...) I can MITM your active connections just fine either way, or spoof your whitelisted IP.

I know everybody likes Fail2ban, but these two iptables rules (or something just like them) actually work better and don't fill up your logs:

      iptables -t mangle -A PREROUTING -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --set
      iptables -t mangle -A PREROUTING -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 4 -j DROP

To actually protect the network layer, use some kind of VPN with MFA.

</comment><comment><USER31> This is interesting in that it combines the concept of port knocking with a REST interface, which I'm assuming is up to the user to create a front end for.

Unfotunately it also relies on Kubernetes which means that using it for a single system isn't practical. At least, not for _this_ server owner.

My own approach is simply security by obscurity (a non standard port) with APF/BFD doing the needful for locking bots out if they figure out the port. I've had to change ports only once in 6 years, so it's working to keep bots out rather nicely.

And really that's all these things are- a way to keep bots out. A determined attacker will figure this stuff out anyway.

</comment><comment><USER32> Secure SSH and you won't have to worry about rogue login attempts, which happen to everyone. If it really bothers you then move it to another port where it will happen less.

But install a new firewall management system? Sounds like it will definitely introduce more risks than the problems it solves, which for the SSH example isn't really a problem at all.

</comment><comment><USER33> Have you tried knockd [https://linux.die.net/man/1/knockd](https://linux.die.net/man/1/knockd) ? You send a special sequence of "knocks" to the server (packets to different ports) and it executes a command such as allowing your IP for a time period. No JWTs.

<comment><USER34> My go-to is fwnop ([https://www.cipherdyne.org/fwknop/](https://www.cipherdyne.org/fwknop/)) which is actually similar to the OP's thing but battle tested. Only downside is it's not available on iOS, so recently I setup WireGuard for my iPad.

And yes, ssh pubkey + fwnop + WireGuard + fail2ban is ridiculous overkill, but hey, it's my homelab server. That's how I learn this stuff.

</comment></comment><comment><USER19> If you're gonna go through all of this work -- including creating and maintaining private keys -- why not just restrict the SSH server to only permit key-based authentication (optionally, signed by your CA)?

If having 22/TCP open to the world is an issue, then set up Wireguard on the host and only allow SSH connections that are coming in over the Wireguard interface.

Got a bunch of machines to deal with? Set up a jumpbox or two running OpenBSD, lock it down, give your users access to it via SSH (optionally, over a Wireguard connection) and then only allow SSH access to all of those other hosts from the jumpbox(es).

Then there's the fact that I have a _whole lot more_ trust in the security of OpenSSH than I do some random web application!

To me, this just seems kinda pointless -- there's a bunch of other, better (IMO) ways to deal with this -- but I guess if it fits your needs ...

<comment><USER35> Step 1: assume every service listening on your network has an auth exploit that has not been found.

Step 2: deploy this.

Step 3: ...

Step 4: profit!

The line between something like this and a locking the service behind a VPN is very narrow. They both achieve the same thing, protect high risk/value targets by not even allowing unauthorized people to talk to them at the network level.

</comment></comment><comment><USER36> > _you can go to jwt.io and generate a valid JWT using RS256 algorithm (the > payload doesn 't matter). You will be using that JWT to make calls to the > REST application, so keep the JWT safe._

The JWT you got after you plugged the private key into a random website is going to protect access to your machine?

</comment><comment><USER37> Adding a JWT authenticated API layer to something is not a first choice for adding additional security.

If you want something like this look into platform level firewalls (ex: AWS security groups) or run spiped in front of your SSH server. I'd trust that a hell of a lot more than a REST API.

</comment><comment><USER38> Requiring ssh keys, disabling password auth, and using ssh bastion hosts is my preferred approach.

<comment><USER39> Yeah it's not clear to me why exposing the ability to configure your firewall, protected by a keypair, to the internet, is safer than just letting someone bang their head against sshd, protected by a keypair, and presumably having had a lot more eyes on it for security.

<comment><USER40> And the distributions can also do the SElinux stuff that I don't use day to day.

</comment></comment></comment><comment><USER41> This looks like reincarnation of "Lock & Key" feature of Cisco routers available since the late 90s. There were two major issues that led to abandonment and hindered adoption. The first is that it's an extra step. Extra steps for installation, for complexity, for single point of failure, for availability of key services. The second is that instead of thwarting attackers, you're thwarting yourself, every single time. It breaks so many usecases, for example if you have a new machine, or if you want to access through a jump host, or from ssh client on phone, etc.

</comment><comment> john-shaffer On EC2, I've had a great experience using AWS Systems Manager [1]. I don't need any ports open, and it works great with normal shell tools and emacs given a .ssh/config like this:

host i-* mi-*

ProxyCommand sh -c "aws ssm start-session --target %h --document-name AWS- StartSSHSession --parameters 'portNumber=%p'"

[1] [https://docs.aws.amazon.com/systems- manager/latest/userguide...](https://docs.aws.amazon.com/systems- manager/latest/userguide/what-is-systems-manager.html)

</comment><comment><USER35> Documentation and idea framing is too snowflaked.

This a JWT based port knocking over https framework that would be useful when used in a much broader sense.

Framing it as proactive fail2ban is technically correct, it also masks the other and more powerful use-cases.

I could see this in use as a vpn bypass for a prosumer production system, where normal operational commands go over a secured vpn but in a pinch, you can disable that restriction for direct control during a partial failure.

</comment><comment><USER42> A proactive way of increasing your attack surface no doubt.

<comment><USER21> A proactive way to shoot yourself in the foot for sure.

</comment></comment><comment><USER43> Please don't use this software. From a security perspective this is horrible.

Option A) Expose all firewall rules via some hacky web-based API.

Option B) [https://nvlpubs.nist.gov/nistpubs/ir/2015/NIST.IR.7966.pdf](https://nvlpubs.nist.gov/nistpubs/ir/2015/NIST.IR.7966.pdf)

</comment><comment><USER44> If you're going to take this approach, a bigger question is why bother running the SSH jumpbox 24/7 in the first place? Shut down the SSH jumpbox when you don't need it (thus achieving SSH isolation) and start it up with your public IP in user-data to enable access to you and only you when you do need it.

</comment><comment><USER45> This sounds like a complex port knocking setup with bigger overhead. If you want better security and UDP is not a problem, consider use of Wireguard VPN. It is passive and silent, random attackers won't even know it is there.

</comment><comment><USER46> Running SSH on a non-standard port gets rid of the brute force login attempts, too.

<comment><USER47> In my experience, a non-standard port reduces the number of brute force attempts, but it doesn't eliminate them. I just do a simple rate limit on syn packets to the port and use SSH keys for auth, and that feels like plenty of security.

</comment></comment><comment><USER48> (1) The auth interface is per IP address, as visible by the listening server. (2) The word "NAT" is found 0 times in the text. (3) There is no point 3 from the practical standpoint, please move along :(

</comment><comment><USER49> Much simpler to stick with SSH and an IP Address whitelist...

Then you can't even get login attempts, unless they're from the same IP... am I missing something?

</comment><comment><USER50> I still think that running ssh over spiped is more secure. Every byte being passed to sshd is cryptographically verified (and encrypted).

</comment><comment><USER51> Can anyone explain what's wrong with "pubkey only, ignore attempts" method?

</comment><comment><USER52> I just whitelist IPs. You can do this easily using iptables or sshd config.

</comment><comment><USER53> Why is SSH open to the public internet at all, ever? Use WireGuard as VPN tunnel to your servers network, then SSH via internal IP.

<comment><USER21> > Why is SSH open to the public internet at all, ever?

Wasn't SSH made for that?

<comment><USER5> Yeah, I trust the OpenSSH developers a lot more than almost anyone else I can think of: if I'm going to trust any services open to the public internet, I'll trust OpenSSH

</comment></comment></comment><comment><USER54> Wow - why didn't I think of just setting up a firewall instead of running fail2ban. Great idea.

<comment><USER55> eh, fail2ban uses iptables to ban?

<comment><USER56> Fail2Ban can execute scripts etc to do things. I have mine making API calls to OPNsense to block IPs there.</comment></comment></comment>


Ask HN: Is a Ph.D. in CS worth it? - <AUTHOR> So, I'm a senior CS major at CMU, and up til now I have taken care to keep both options (Industry and Grad School) open to me.  Unfortunately (or, perhaps, fortunately), it's about time to make a real decision, so I figured I would just gather as much (hopefully unbiased) information as possible.
So, given the choice between a top tier Grad School and a top tier company (whether it's a cool new startup or an established player), which is the better choice?
For the sake of eliminating the easy answers, you can assume that I'm not sure that I want to teach and that the opportunity cost doesn't bother me.
Edited to add: Whatever I work on, I want it to be cool and new.  Research affords a good opportunity to do that, but I believe a job could as well. <comment><USER2> Besides being a door-opener for research jobs, pursuing a PhD is also a great chance for personal growth. You will be challenged on many, many levels and thus likely develop skills that you never knew you were lacking in the first place. In my view, the world becomes larger in grad school; you'll get to see so many hard questions and unknowns that your appreciation for existing knowledge will no doubt grow.

There may be jobs in industry that allow for similar growth, but they are certainly not the norm. It is easy to stay within one's comfort zone once one gets paid to do so.

In my (completely biased) opinion, doing a PhD is worth it for great and curious students that like to be challenged and that can afford 5 years, no matter what you plan to do afterwards (in fact, especially if you don't know what to do afterwards). You can always be a code monkey for 50 years after the PhD; it's hard to go the other way.

<comment><USER3> I completely agree that you learn all sorts of unexpected things doing a PhD that are often unrelated to the specific field you're working in. Lots of these things seem to be common across the experience of many people, but some of them while be uniquely yours.

But lots of what you'll have to do won't be cool or new, it will be tedious and time-consuming drudgery. Of course, it still might be worth it, but don't expect it to be all sunshine and light.

</comment></comment><comment><USER4> If you think you might want to teach, go for the Ph.D. now. You're at CMU and doing research (from your comments), so you can get some recommendations and possibly basically direct placement into top-tier schools. That opportunity goes away with years, as does the ability to live on ~22k/year.

If you want to work on the more researchy problems while in industry, also consider the Ph.D. Even the Master's is just a "quick pay grade upgrade" but won't get you into the research labs at MSFT, etc. You'll be just another hacker, albeit one with one additional line on their cv. Most of the graduate students I meet (in Computer Science) have no interest in being professors -- they mostly want to work in research labs or use the Ph.D. as a leg-up towards a CTO job.

If you don't care about either of those, go into industry.

</comment><comment><USER5> You don't have to decide whether or not to do a Ph.D. right now. Just begin grad school and after you've finished a master's degree decide whether you want to continue on and do a Ph.D. or not.

I felt like I had to make the decision early on in grad school, but that's not the case.

Do a master's (thesis option) degree and in doing so you'll discover whether you want to do research or not. If you decide you absolutely love research (and all that goes along with research - publishing, perhaps teaching, etc.), then go for the Ph.D., otherwise, finish with the master's degree and go into industry.

<comment><USER6> In my case I wasn't sure whether I wanted to do a PhD so I went for a Masters first. After finishing a Masters I didn't feel as though I did "real research". To an extent I feel research given to M.S students is not as interesting and will have to be much smaller in scope due to length of time a M.S student has. It seems to me the only way to really know whether you like research is to be in a PhD program doing research. Although this isn't a great answer because it requires investing a lot of time. Thats my experience at least.

</comment></comment><comment><USER7> Whether you want to teach is moot. The top tier schools are not about preparing you to teach, they are about preparing you to do research. There are many options after a CS PhD and most of my classmates are not teaching now.

Getting into a 'top tier grad school' is a crap shoot, much like a getting into a 'top tier' company. You should probably figure out whether you want to spend a lot of time doing research or not, and look into whether you like the sort of jobs CS PhDs wind up doing after a PhD, not phrase your queries narrowly in terms of which top tier option is better.

<comment><AUTHOR> The only reason I said anything about teaching was to eliminate the "Well, if you want to teach, you have to go to grad school" argument. I kind of understand that and figured I'd trim that discussion.

I understand what you mean by the crapshoot part, but, given the choice between a top tier company and a middle tier grad school, I'd go with the top tier company every time. Between top tier grad school and middle tier company, I'd choose the grad school. Maybe this is a little shallow of me, but it seems like a reasonable heuristic, all other things being equal.

<comment><USER8> Looking at your resume, you've got decent experience with both undergraduate research, TA'ing, small companies and a large company. I had similar experiences at CMU when I went there (for ChemE, not CS), and I decided that entering industry (in 99, a great year to get hired) was better. If I'd graduated in 2001 or 2002, I'd probably have stayed in grad school. How is recruiting looking at CMU this year? Do you have solid job offers already? Does the professor you've been doing research with have any suggestions about where to apply to grad school?

A friend of mine graduated with a CS PhD last year, and he just took an interesting job working on the key algorithms behind one of the "big names" in tech today. But other opportunities he was offered were the same as he would have gotten with 10 years of software development experience.

I'll also say this - if you don't get your PhD now, it's a lot harder to go back and do it when you have a mortgage and other commitments.

</comment></comment></comment><comment><USER9> A colleague of mine at IBM Research and I made a presentation on the subject that we used to give to college students.

<http://www.woan.org/Presentations/Crossing.pdf>

I think that others mentioned that you really want the PhD if you want to go into research and especially if you are interested in the search for truth rather than good enough to work in the real world. Kind of like the difference between science and engineering.

Coming out with a PhD from a top school means that you will more than likely be the world's expert in something (whether that something is important is another question) which is pretty cool.

<comment><USER10> Definitely TOP SCHOOL though. I've met and worked with many PhD CS students from the lower end of the spectrum who were nothing more than book smart, in the worst way. I guess lower and mid tier schools just don't require real innovative thought out of their graduate students. They couldn't apply their knowledge in any way to solve any problem. Their graduate work was neither innovative in a scientific or practical fashion. They were relegated to business analysis & project management at a major corporation. Yuck.

</comment></comment><comment><USER11> A PhD is research training. Do you want to do research?

<comment><AUTHOR> I want to do cool stuff. I have done research (currently semester #3 of it) and have generally found it to be new and exciting, but that's also how I've felt about working on Mongrel2.

If you told me that the only way I was likely to find new and interesting problems was to go to Grad school, I would choose grad school.

<comment><USER12> I'd go even further and say get a PhD only if you want to be a professor. If you just want to work on interesting projects in industry, a Masters degree might be a better RoI.

Also consider the increased difficulty of re-entering the commercial workplace after spending a long time working in an uber-specialized field while getting the PhD. If you're more of a generalist by nature, don't do the PhD (this is advice I wish someone stressed to me before I did mine).

There have been several other similar threads to this on HN from memory which also contained some solid advice.

<comment><USER13> Yeah I think I would agree. I did a PhD without wanting to go into academia and while I had plenty of reasons for doing it I'm not convinced it was a great idea.

I think part of wanting to do a PhD is wanting to complete the ultimate intellectual marathon. To get that seal of approval. Its a really stupid reason and I strongly suggest you do some soul searching as to which parts of your ego feel they need that validation.

Cool and new. Yeah I think that might have been how I described my motivation as well. I don't think research is about cool and new. I think successful research is about learning a difficult and advanced area and then carefully contributing a very small uncool piece of the puzzle. I think trying to be creative gets you shallow and unuseful work.

It's probably better to think about the PhD as learning about a really specialized subfield and a small amount of contribution. I'd also say only certain subfields are worth getting a PhD in. In some fields like machine learning a PhD can be an entry into all sorts of useful jobs and roles, in other fields its only an entry to academic roles, and finally in some fields it won't be a good entry to academia and industry will be left scratching their heads as to why you wasted your time.

<comment><USER14> One of your previous comments is, I think, one of the most succinct descriptions of why I'm planning to leave CS academia. (That said, CS academia has been pretty good to me.)

 _"While amazing, groundbreaking research is possible in academic computer science - the general lifecycle of research is some irrelevant poorly made prototype that ignores any number of real world concerns and leads to a couple of uninspired papers that noone reads."_

<http://news.ycombinator.com/item?id=1376259>

<comment><USER13> Well that was definitely my experience, I'm not sure how well it generalizes.

I think there are probably some deeper factors at play in this. I think in most fields of computer science its hard to articulate the importance of the research in itself. That is I think my vague outsider view of Maths and Physics research is that its easier to quantify the significance research on its own. In CS I feel their is a stronger need for outside justification - that is this research will do x faster or better - but that research tends to be divorced from industry to the extent that it rarely contributes directly. Fundamentally there just isn't as much need for academia in lots of fields of CS - it doesn't take expensive equipment and its not so abstract that it can't be undertaken by a profit seeking concern. Add to that most universities want to take good research patent it and spin it off anyway, and you might as well just start a company and keep your equity.

</comment></comment></comment></comment></comment></comment><comment><USER15> I'm just finishing my PhD thesis in CS now. Like you, I don't want to work in academia. Was it worth it? It's a tough call.

I greatly appreciate the time and relative freedom that my PhD has given me to develop, but not all of that development will be applicable out there in the real world. I think most people moving from PhD study into industry have to make something of a sideways leap, and you can't expect the same level of remuneration as you'd find in a job you're qualified for (i.e. research).

In my recent job-hunting, I've had a really hard time convincing potential employers to trade my overeducation against my inexperience. Recruiters, who often just match acronyms on a CV/resume, are particularly tough in this regard. One told me that, despite me having a PhD, he would only put me forward for roles that said 'new graduate' or 'no experience required'.

You can combat this, however. In my experience, there's time when doing a PhD to do some extra-curricular stuff—to work or to develop personal projects. These will help you to look less like the kind of narrow-minded, misanthropic pedant that people expect from a PhD student.

In summary, the only thing a PhD will qualify you for is research. Having a PhD, as prestigious as it is, is only as useful as you make it, so your choice of topic and extra-curricular activites are essential. If you're considering a PhD because the jobs your ideal job isn't open to you, consider whether taking the sideways step into PhD study is really the most direct route to the job you want (read: it probably isn't).

One more thing: be aware that your relationship with your advisor is crucial. Quitting because you can't stand them two years into your PhD means starting over, so choose wisely. Don't choose them based on the person you want to be, choose based on how they fit with who you are now.

All the best.

</comment><comment><USER16> I did an MS in CS with a thesis. I was not at a top tier university. I would recommend going on for the MS at least. It was fabulous in its own right, well worth the delay entering the workforce.

It was also a great way to figure out that I did basically enjoy CS research, but I'd need to feel a real burning sensation to spend the time on the PhD and get hired at the Google lab. Tenure-track seems to be for masochists only.

After the MS I took a fairly good job, then 18 months later moved on to a top tier company. You can probably go right to a top-tier after CMU and a master's.

</comment><comment><USER17> One could say a number of things, but I'll just say this: I would suggest that you consider working for a bit in between undergrad and grad school. If you had a strong chance of getting in directly from undergrad, then it will remain so after a year and a half (when you'll need to apply), especially if you keep in mind from right now that you should keep in touch with your advisors / rec letter writers. Two years of work is reasonable; one is usually too little to get into the swing of things and three starts to get a bit long and it will become harder to get admitted.

This has a number of benefits: worthwhile non-academic experience, better sense of whether you really want to do a PhD or whatever else, usually more focus when you do go back because you have had time to reflect on what exactly you want to do and get out of it, some general maturity that comes from working rather than just being in school, less pressure in making a big decision right now, and so on. Since you aren't hell-bent on becoming a professor, it is good to see both some academia (your undergrad) and industry before jumping into a long-term thing like a PhD. It's also more comfortable applying to grad school from a job you already have rather than as an undergrad, since if you don't get in anywhere you like, you can simply stay at your job and even try again the following year. (This also all applies if you decide you just want to do an MS.)

Basically, you have to make your own decision about this, and this is a fairly simple (and productive) way to make the decision easier.

</comment><comment><USER18> I did the Fifth Year Masters program at CMU because I was in exactly this position. I recommend talking to Stehlik about it.

</comment><comment><USER19> Matt Welsh (Harvard CS systems prof) has a great post on the topic: [http://matt-welsh.blogspot.com/2010/09/so-you-want-to-go-to-...](http://matt- welsh.blogspot.com/2010/09/so-you-want-to-go-to-grad-school.html)

"The only reason to do a PhD is because you love doing research. If you don't love research, don't bother -- it is not worth the time, money (in terms of opportunity cost vs. making a real salary in industry), or stress. Doing a PhD is stressful, if you are doing it right -- you are in constant competition with other academics to publish your results in the top venues, to make a name for yourself, to get recognized. If you harbor ideas of lazy days sitting in the coffee shop pondering the universe, you are dead wrong. (You can always approach a PhD this way, but you will probably not be very successful.)"

</comment><comment><USER20> I graduated from CMU CS in 2009 and chose to start up instead of doing grad school (<http://www.shoefitr.com>). We were funded by AlphaLab and are still based in Pittsburgh.

I, too, was looking to work on something cool and new, and you can certainly find projects that meet this criteria in both startups and academia. The decision for me was easy because I was passionate about the idea, and I was excited to start building. The serious thesis work in grad school would still have been a couple years away, and I wasn't as excited about taking more classes. I wanted to get started immediately.

If you'd like to grab lunch and talk more about the start-up world, I'd be happy to try and lend my perspective. (My co-founders and I live in Shadyside).

</comment><comment><USER21> Hedge your bets. Start talking to professors this semester about grad school and getting recommendations. Then tell them later you've decided to do a year of startups\industry. If you are on good terms with them, they will be fine with submitting recommendations 1 year later. You'll just have to let them know what productive things you've been up to in that year. Their only concern is that they aren't damaging their reputation by recommending burnouts.

In the meantime, get involved with other students on building stuff outside of class this year! Once you find a specialty of CS you're passionate about, whether it's statistical machine learning or web development, it'll be obvious which path is the best choice.

</comment><comment><USER22> check out this thread on Quora: [http://www.quora.com/What-are-the-advantages- and-disadvantag...](http://www.quora.com/What-are-the-advantages-and- disadvantages-of-doing-a-CS-PhD)

</comment><comment><USER23> Both options are great options. Obviously, either way can further your career, so you should be asking which is a better fit for you.

For example, ask yourself - would you enjoy doing a PhD? If you wouldn't have fun, then don't do it. A second question is - what careers would make you happiest later on? If those careers don't require a PhD, then consider not doing one.

Also: Are there multiple CS research topics that would interest you? Are you self-motivated and good at working on long-term projects? Are you happier implementing things or thinking about how to implement things?

</comment><comment><USER24> If it's a top 10 school then do it. You can get a job anytime, but the window on grad school shuts quickly. If you don't like it after 2-3 years, take an MS and quit. Grad school is fun.

</comment><comment><USER25> I think this essay by PG is appropriate here. <http://www.paulgraham.com/love.html>

</comment><comment><USER26> IMHO a PhD like any other education is just potential energy. It's meaningless unless you can apply it, or someone else can. I would save some money and do a startup however small. This way you know if your making something of true value rather than something you find just interesting. One of my cofounders has a PhD but he worked on various startups during his thesis.

</comment><comment><USER27> Grad school is a self induced neurosis. If you don't know what you want to do, you can learn and pivot faster by doing stuff in industry. You can always go back to grad school.

Also, a PhD may work against you. Many programmers in smaller companies will think you aren't interested in working hard.

</comment><comment><USER28> If you enjoy research, yes.

</comment><comment><USER29> No don't do it. PhD's suck.

-Dr. Moriarty

</comment><comment><USER30> Research in pure CS is likely going to be math oriented. Do you like the algorithms and proofs in your classes? Do you like them well enough to do them for a nice fat chunk of your life? Do you like them well enough to go into significant debt (unless you have bank already)?

More important than that though: Is there a particular subject within CS that you are INCREDIBLY passionate about?

<comment><USER31> This is not true. There is plenty of PhD work being done in things like AI, distributed systems, databases, programming language design, programming language runtime design, and many other topics that are not mathematical.

There is plenty of work involving math, if you like, but there is a lot more to computer science than linked lists and finding strings inside strings.

<comment><USER32> Actually, I just checked and almost every CS field rests on substantial understanding of math, you can safely ignore the parent post.

<comment><USER33> I'm going to defend my Ph.D. in December. I agree with the parent post. Check my profile for my academic page, which has my publications. I do research related to systems for high performance computing. Not much math. Mathematical reasoning and understanding is needed, but the research is not math.

I'm going to steal from myself and just repeat this: I consider computer science to be everything concerned with computation in both the abstract and in implementation. See <http://news.ycombinator.com/item?id=968013> and <http://news.ycombinator.com/item?id=1131606></comment></comment></comment></comment>


Ask HN: Would we even know it if China were flying hypersonics over the US? - <AUTHOR> These things always seem crazy until they happen to you:  I was laying on the couch the other day and I heard what can only be described as a loud explosion or booming sound that echoed through my neighborhood.  Being that no one in my neighborhood was talking about a transformer station or someones water heater exploding, and there wasnt a cloud in the sky, and its well before frost season, and I dont live near a military facilty, or major fault, and it wasnt trash day, ive been stumped coming up with an explaination.  My dog went crazy when it happened so it wasnt just me.
This got me thinking about the hypersonic jets in the news, and I was wondering, if something that fast were developed would anyone (including the us military) know about it being flown right over our heads?  Or would it be exactly as has been happening over the last month, just a series of loud booms heard across the US that everyone chalks off to random noises, frost quakes, etc.  Another detail, my sister reported hearing the same sound the same day.  She lives about an hour away to the northeast.  I live on the northern suburb of a very large city, and people elsewhere in the city werent talking about it, so it must have been localized in some way.
Anyone have any more rational and critical explaination for the loud sounds being reported across the US more frequently this month, or is this just more of the same, and its possibly just psychological that people are noting an uptick in the reports of innocuous sounds? <comment><USER2> There are reports of such booms occurring around the world. It's very odd, and no one seems to have any answers.

</comment><comment><USER3> Hypersonice aircraft would likely show up on radar.

<comment><USER4> [http://www.thedrive.com/the-war-zone/16079/airliners- and-f-1...](http://www.thedrive.com/the-war-zone/16079/airliners- and-f-15s-involved-in-bizzare-encounter-with-mystery-aircraft-over-oregon)

In the story they said they were having a hard time tracking it with radar

<comment><AUTHOR> Exactly, would we even know it if china's hypersonic military were in our airspace right now?</comment></comment></comment>