Libraries have become a broadband lifeline for students - <AUTHOR> https://arstechnica.com/information-technology/2017/03/cloud-changes-school-3/ <comment><USER2> I live in a suburb of Los Angeles and I occasionally do work at a local library branch. I overhear a lot of the patrons' conversations at the reference desk. It's astounding how much people still struggle to find quality information in "the information age". It's no surprise given the rise of poorly vetted articles spread on social media.

I realize how much of a role librarians can play in guiding people towards more reliable information sources. The key takeaway from the article shared is that libraries are still effective places for people to build self-reliance with regard to information seeking. It's an important skill that doesn't always get taught in schools for whatever reason.

<comment><USER3> I believe that the ability to filter out low quality is a symptom of the declining role that libraries play in our educational system. I was privileged enough to go to schools that had libraries and trained librarians attached. Part of our curriculum included a library class in which the librarians taught us to investigate the credibility of a piece by actually reading the sources cited.

Modern resources such as Wikipedia are a treasure, but are only valuable if examined with a critical eye.

Support your local libraries, especially their outreach programs.

<comment><USER4> I respect your opinion and the belief that library education continues.

I think a far greater cause is the lack of critical thinking taught in schools, the lack of engaged debate and encouraging people to think for themselves and gather their own information. We had to write persuastive papers, research topics from encyclopedias, etc. It seems kids don't do that in school these days. (get off my lawn)

<comment><USER2> FWIW the patrons I mentioned seem to skew older. Often they are convinced that the mainstream media or local government body x is stifling coverage of some news story they want to know more about. These are generally along the lines of the "pizzagate" story. One woman recently was convinced the government was blocking the AM radio broadcast of some political commentator.

I want to highlight that these are completely normal looking middle aged men and women that do not appear to be under the influence of drugs. These are not the (false) stereotypical backwoods conspiracy nuts. Again, this is suburban Los Angeles. I don't know what their educational levels are or where they attended school, but clearly (and stating the obvious) -- our educational system is failing to impart basic research and critical thinking skills to huge sections of our population.

<comment><USER5> I'm willing to bet that many younger people are skeptical of mainstream media nowadays, too. The collusion between media and the DNC to suppress Sanders from being the democratic nominee made me bitter at least, and I'm willing to bet it's made a lot of other people bitter, too. Then with the blatant clickbait claims that Pewdiepie is racist, white people cause all of our problems, and "8 [whatever] you just CAN'T live without" posts, I don't see my trust in media ever returning.

<comment><USER3> I've thought about that recently. The right type of skepticism came out of the election. I'm grouping all sides/factions together and, I may be wrong, but I don't see it as an increase in critical thinking. I just see it as an outright dismissal of the credibility of any information coming from the nebulous establishment or mainstream, accompanied by an acceptance of any conspiracy theory that paints the mainstream in a negative light. It's skepticism that discriminates based upon the messenger, not critical analysis of the content of the message.

I joke, but I also weep knowing that if there were an article that claimed that either candidate supported relaxing or increasing regulations on the chemical dihydrogen monoxide, a significant number of people would think it was a serious issue without actually researching it.

Just my 2c regarding PewDiePie: He may be a youtube star, but he not a comedian and not humorous IMO. Don't make jokes about touchy subjects if you aren't exceptionally funny or have a very thorough and intimate understanding of the subject. There's a reason Louis C.K. can do skits on controversial subjects without being pilloried, he's not a crass amateur. If no one laughs, at best it comes off as insensitive. Also, his fan base is primarily 12-15 yr olds, not exactly old enough to understand the subtleties of satire. Kramer's racist rant post-Seinfeld at least was aimed at adults.

</comment></comment></comment></comment></comment></comment><comment><USER6> Sadly though, Trumps budget would completely eliminate the Institute of Museum and Library Services. This would be devastating for library services cross the country.

[http://www.ala.org/news/press-releases/2017/03/president- s-b...](http://www.ala.org/news/press-releases/2017/03/president-s-budget- proposal-eliminate-federal-library-funding)

<comment><USER7> Yep. Why do we need libraries? We should instead fund the military with billions of dollars because that's how we make this country great.

<comment><USER8> Well... that's actually true. The US are where they are because of their military power and intelligence.

<comment><USER9> You don't build tanks and planes without them. Nuclear bombs without them.

Look at south korea. Plenty of military, no brain.

<comment><USER10> > Look at south korea. Plenty of military, no brain.

I'm genuinely curious - what did you mean by this?

<comment><USER11> I think he meant North Korea. But they did build a Nuclear Bomb (or rather got the tech successfully loaned from China)

<comment><USER12> According to some high-ranking North Korean defectors, they actually built it themselves with no direct assistant from China or Russia -- which explains why they are so crappy. Their nuclear program is still young and poorly funded.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> I volunteered at my local library and they were struggling at times in terms of man power. I think they had too much responsibility but the budget of someone who handles books only. Books, Internet, Movies and music, Free lunch for kids under 18, Some computer classes occasionally, Meeting areas for adults, Club activities for kids, Occasionally local cops organized "Pokemon Go with an Officer", magazines, subscription to many newspapers, etc etc. Most people don't think of volunteering in libraries either. They were back logged with shelving out the books that hadn't been checked out in a while. Without doing this, they can't really keep getting new books. Trying to manage the CD/DVD is also more hassle than you think. You have to regularly clean it and get rid of the ones thats too damaged. My college library is decent too. Nothing like the public one. Especially considering the college one probably is better funded. A lot of people from a lot of different age group depend on the library for the internet though.

</comment><comment><USER14> If you haven't been near your public library's internet area for a while, you should go--it is an eye opener to see not only that they are full to capacity, but also that there is often a wait list involved.

<comment><USER15> I was in Boston last week on business, and I took a meeting at the Boston Public Library downtown in Copley. I had the exact same thought walking through that area on a Saturday morning. It was packed (although not quite to capacity). I casually observed what was on screens, and it was everything from Facebook, to games, to Wikipedia.

<comment><USER16> I suppose I haven't been to many large main branch libraries, but the BPL main branch is amazing to me. The building itself is incredible but the services they provide are top notch.

It hosts great scheduled talks/discussions (for instance on Tuesday Neil Gaiman will be there for an on-stage interview).

The quiet workspaces are great places to get work done, and something about the architecture/interior/history really helps keep one motivated while there.

Maybe this is normal for every state but any resident of MA is eligible to get a library card. It's worth it for the digital rentals alone.

They also host free tours of the building, which I haven't done yet but have been meaning to.

</comment></comment></comment><comment><USER17> Certainly rings true here.

Anecdote: My cousin lives in a rural area and is enrolled in college while working. His only internet at home is satellite, so to do his online homework he has to drive to the library to use the wifi.

</comment><comment><USER18> Once we had a dream of sharing wifi among each other. What happened to that?

<comment> yjftsjthsd-h Administrative overhead and piracy issues?

</comment></comment><comment><USER19> Ironically we go to the library much less now that its easy to borrow ebooks with kindle and reading apps. overdrive is great. I was starting to see a future without libraries.

<comment><USER20> The libraries here seem to have transitioned heavily to services and tech.

The computers have not only internet, but MS Office and Adobe products, and I see everything from playing games and social media to job hunting and learning being done on them. (There's even a special bank of computers with resources for job hunting downtown.)

Pretty much every day, the library holds some kind of starting a business, learning to use tech, ESL, or other kind of class.

Then there's the cultural shows (opera, movies, story readings) and free tax prep services at the central branch downtown.

The library also provides desks to work at, which are used by students (HS and college), professionals, the homeless, etc. The value of a workspace in the city is itself fairly large. I made frequent use of it when working as a freelancer. Cheaper than coworking space, cafe on site, reliable internet, etc.

And of course, the library is still a library. Their ebook collection is nowhere near the size and scope of their physical book collection. Not just the normal stuff of _modern_ books, but fairly large archives of things like financial reports, magazine editions, etc stretching back nearly 100 years (longer in a few cases), a rare book collection, specialty archives, a collection of official government documents, and probably more Im forgetting.

That isn't stuff I need every day, most of my borrowing is (or could be) ebook/audiobook, but I think the city would be poorer without a publicly owned archive of history, even if there were digital copies available. There's something about reading a book older than your great grandparents that digital copies don't replace.

<comment><USER21> People have a hard time realizing libraries are so much more than books these days. I'm a former library employee, and it was always interesting seeing how the library adapted to interests and needs of the community.

My local library now has as big of a movie rental library (for free!) as any Blockbuster back in the day, has 3D printers available for use, and office areas meant for use by startups needing some space to work.

<comment><USER20> I knew I was forgetting things!

The library has an extensive DVD collection (TV, movies, etc), CD collection (music, etc), script collection (plays and other theater), sheet music collection, music practice rooms, and of course, a foreign language collection for all the kinds of media.

Oh! And a collection of maps, covering both a large geographic area _and_ over time so you can see the evolution of local cities. (Actually, 3 map collections -- US government Dept of Interior/USGS, other broad scale ones, and then a special collection for local ones.)

Im pretty sure I'm _still_ forgetting things. The library system is actually kind of awe-inspiring in what they manage to collect and archive. Once you consider their relationships with local university archives, other cities, and county level systems, their total system is staggering.

I could never say enough good things about the library, and it's one of the best civic investments we make because it does so many things at once.

</comment></comment></comment></comment><comment><USER22> I'd love for libraries to get involved more in tech. I think they are really the ideal public sponsored unit to move quickly and break things in a way that school's aren't.

I have a nephew who is 2.5 with 2 uncles involved in tech and his dad writes some code part time. We've already talked about getting him into programming and electronics.

As technical skills become more and more important I worry that the school system just isn't fast enough to adapt and there is going to be a massive inequality between kids who have relative/parents who encourage the development of these skills and those who don't.

</comment><comment><USER23> My local library has 250mbs of fiber going to it. Nothing amazing in the days of gigabit but it's by far the best free internet access you can get. However, they have it locked down to just web traffic. You can't use GitHub, download any software, SSH into a server...</comment>


Performance variation in 'identical' processors - <AUTHOR> http://shape-of-code.coding-guidelines.com/2020/01/05/performance-variation-in-2386-identical-processors/ <comment><USER2> In the 90's I was an architect on Intel's Willamette (Pentium4) thermal throttle (TT1). TT1 "knocked the teeth" out of clock cycles if the checker- retirement unit (CRU, the hottest part of the die) got too hot. This evolved into TT2/Geyserville (where you move up/down the V/F curve to actively stay under the throttle limit). We were browbeaten by upper management to prove this would not visibly impact performance and worked on one of the MANY MANY software simulators written throughout the company to prove this. (It was actually my favourite job there.) This is when the term "Thermal Design Power" arrived: top marketing brass to avoid using "Max Power" which was far higher. It is possible to have almost a 2x difference between max power (running a "power virus", which intel was terrified of from chipsets, to graphics, to CPUs) and what typical apps use (thermal design power). Performance was a bit dodgy on a few apps, but not a significant compared to run-to-run vairation. (Remember this is 1995-1997 after the half-arsed Pentium fiasco in 1993 when Motorola openly mocked intel for having a 16W CPU... FDIV wasn't thermal fiasco, but it was a proper cock up).

Die are sorted based on something called a bin split: die are binned immediately after wafersort based on their leakage (there are special transistors implanted near the scribe-lines that indicate tons of characteristics, as well as DFX units through out the die that are rings of 20 inverters that oscillate, also indicates tons of data on how the die behave, however testing the those buggered DFX circuits takes an enormous amount of time, and you can't slow down wafersort, so there are proxies).

The bins are designed in such a way to maximize profit and performance based on the die characteristics. Thermal throttle plays a role in this and each bin (among various vectors) is allowed some tolerance, which is exactly what OP has discovered. However, this has been going on for coming up on 30 years! So nothing really new here, I just thought I'd let you know that of course Intel is aware of this, and they never claim performance numbers outside of the tolerance allowed for thermal throttle.

</comment><comment><USER3> There seems to be little attempt to ensure the ambient environment of the processors is isothermal. That is, there's likely significant chassis to chassis thermal variation that is as big or larger than any difference in thermal budget between processors.

Even things like the characteristics of the application of the thermal paste and the roughness of the individual fan ducts can matter, beyond the obvious bottom of rack vs. top of rack, position of processor in individual chassis, etc effects.

tl;dr-- probably most of what is measured is not silicon to silicon variation.

<comment><USER4> I have a pair of "identical" GPUs which have dramatically different performance. Swapping the order didn't help. It turns out it was because one was blowing hot air into the other. Sigh.

<comment><USER5> I have seen this happen before. In the 1990's I was an audio engineer for a radio station that had just spent millions on digital suites with hard drives that would crash regularly, destroying in-progress work.

The station actually got techs to fly to Australia to try to diagnose the problem -- A bunch of SCSI disks stacked vertically was causing the topmost drive to overheat.

<comment><USER6> Had a similar experience with a JBOD chassis. The vibrations of the spinning drives caused resonance on some positions. The cure was to attach a patch of duct tape with a washer at a certain point on the chassis.

<comment><USER7> Heh I remember in the late 90s I put some rubber between the hdds and case to greatly reduce the noise of my desktop PC.

<comment> the-dude I have seen rubber 'sleeves' for hdds

<comment> java-man I don't understand why this isn't a standard practice.

<comment><USER8> That sounds like a really easy way to make a hard drive overheat.

Way back, I had a 4GB SCSI hard drive that was extra tall, extra fast, extra noisy, and extra hot. I constructed a thick rubber box around it to try noise- proof it a little, but I also had to strap a CPU cooler to it and have the airflow enter the box and exit at a hole in the box after wrapping all the way round the hard drive. It worked. But just wrapping it in rubber would have been a very quick way to cook the drive. This is a drive that if just left running bare on a table would get too hot to touch.

Hard drives produce a heck of a lot less heat these days.

<comment> java-man An elastic mount does not have to be a suffocating box.

Plus, and I could be wrong here - the mounts are not really designed to be heat conductors (the rails are plastic on my high end Dell workstation); I suppose the heat is extracted via air flow.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Interesting, but the discussion of "an atom here and there" affecting the performance doesn't make sense. The manufacturing variations are much larger than an atom or two. This variation is part of the motivation for "binning" of processors, testing them and then selling them at different performance levels based on how they turn out.

</comment><comment><USER10> This isn't new. Processors are often the same template for multiple models and manufacturers "bin" based on quality and just turn off the bad parts. This is why it's more expensive to produce a nicer processor: the yield rates are much lower. There is still significant variation in models, though, known as silicon lottery. This is why some chips overclock or undervolt much better than others. There's even one site that sells chips that basically go through extra binning to ensure a better product: [https://siliconlottery.com/](https://siliconlottery.com/)

</comment><comment><USER11> Whether or not this article controls properly for temperature, it introduced me to violin plots: [https://en.wikipedia.org/wiki/Violin_plot](https://en.wikipedia.org/wiki/Violin_plot)

</comment><comment><USER12> I'm surprised that, even at the same frequency, there is still some pretty large variation. I wonder if that's due to other sources of noise that are often ignored by a lot of people running benchmarks (e.g. background processes, SMM, ME, etc.)

 _e.g., memory, which presumably have their own temperature characteristics_

To my knowledge, and this is based on DDR3 and older; memory frequencies are essentially fixed because the transceivers on both ends need to sample in the _middle_ of a bit cell, and to do that they need to know the clock period, which must not change once it's known. There's a delay-locked-loop (DLL) in the RAM which generates a phase-shifted local reference clock.

If the processors could all be locked to one constant frequency (i.e. all the power/performance "dynamic tuning" stuff disabled) that would help show whether there's other sources of noise. This of course also assumes the clock generators are identical.

</comment><comment><USER13> This would be a fun experiment to run at Google, much bigger data set would be available.

</comment><comment><USER14> Ugh... Had two PCs with the exact same spec (CPU, motherboard, RAM same product number, etc.), all same versions of Linux, firmware. Had 15% in performance difference between the 2 gears. Turned out to be some bios tuning, not really related to performance. 15%...

<comment><USER15> _> not really related to performance. 15%..._

I would say that if it make 15% difference it _was_ related to performance... It might not have been an option on a screen specifically stated as being performance related options, but that could just be a bad menu layout.

I'd be interested to know what the option was, if you have any specific memory of that?

</comment></comment><comment><USER16> The variances are likely to be even more noticeable nowadays as modern (x86 at least) processors do a lot more automatic overclocking based on temperatures.

</comment><comment><USER17> aka Silicon Lottery.</comment>


50% US green card holders want to return home - <AUTHOR> http://www.rediff.com/business/slide-show/slide-show-1-why-50-pc-us-green-card-holders-want-to-return-home/20110504.htm

<comment><USER2> Note: 50% of US green card holders of Indian origin. Not the same thing.

<comment><AUTHOR> True</comment></comment>


Ask HN: What if we built new cities with a strictly limited footprint? - <AUTHOR> What if a cities were built up instead of out? What if were so small you could walk from one end to the other in 25 minutes, but it still occupied +100,000 people?
I've been thinking about this "micropolous" a lot lately, and I think it would have a lot of advantages.
1) No cars. Enough said there. 2) The micropolous would be surrounded by a large green loop, so even if the city itself were packed closely with tall buildings, everyone would have access to plenty of outdoor space. 3) If streets are only used for walking, they can be taken over on weekends tables and chairs for cafes, bars and restaurants, or for kids to play in, thus making the city really fun to live in. 4) A lot of the things governments have to do don't really scale well because of distance. Maintaining roads, sewers, water mains, mail delivery, trash pickup, police patrolling, school bussing, etc. are all made incredibly complicated and expensive because they have to serve each and every building over a wide area. Limiting the distance limits what city governments must do (ie less government and less taxes without less service). 5) Since the micropolous have such a small footprint, they can been squeezed into some pretty nice areas, like in a lush valley, or between a mountain and lake so denizens can easily ski in the winter and relax on the beach in the summer.
Who wants to move to my new city? <comment><USER2> As a life long science fiction reader, I feel the "arcology" concept has been imagined for a long time in many different ways. I think the idea is inevitable, although probably more Caves of Steel than Trantor. And hopefully not Judge Dredd.

</comment><comment><USER3> I do!

See also:

[https://vimeo.com/131396094](https://vimeo.com/131396094)

[https://twitter.com/stevedombek?lang=en](https://twitter.com/stevedombek?lang=en)

Also, [https://www.amazon.com/Nature-Economies-Jane- Jacobs/dp/03757...](https://www.amazon.com/Nature-Economies-Jane- Jacobs/dp/0375702431)

</comment><comment><USER4> Sure, I'd live there. Certainly a city like you describe beats most of what we currently have.

One problem. We don't generally build "new" cities. Towns and cities evolve when people have a reason to live somewhere. Which reasons usually come down to job opportunities. (Or for retirees, nice weather, and stuff to do.)

Once you have critical mass of population (we're talking hundreds of thousands), a city often generates its own opportunity, but getting to critical mass is very difficult to do deliberately. How do you propose overcoming that obstacle?

</comment><comment><USER5> A lot of issues would be solved if multiple such cities covered a state,however if there will be only a few such beautiful cities then expect the crowd coming in all the time and once the momemtum picks up the city will expand. And controlling the crowd can be a nightmare. But it can be achieved. Adding a low carbon footprint methods like solar cookers,urban forests(dont mind the insects) may help also. The concern with such an idea has been scaling up in a sustainable manner,almost every ideal city has ruined because of the population boom

</comment><comment><USER6> You might like checking this out, similar to what you've outlined. (doesn't hit all your points, and more of a vacation destination, but some people live there year round)

[http://www.architectmagazine.com/design/urbanism- planning/ho...](http://www.architectmagazine.com/design/urbanism-planning/how- seaside-helped-revive-urban-design_o)

We used to go there every summer. Now it's getting more crowded and losing some of it's charm.

</comment><comment><USER7> How do I get a ride to the hospital with no cars and streets covered with tables? I would invest in real estate in a city with high demand and finite footprint but I would probably not live there. I think you may also find that government service costs per capita may be the same or higher than a regular city.</comment>


Ask HN: As a founder, what do you wish you knew about security? - <AUTHOR>

The reason I ask this question is because I have joined an accelerator program as a security mentor, and would like to focus in on the areas that are going to be of best value.
This question relates to physical, network, application, and operations security, as well as business risk management.
Thanks for your feedback! <comment><USER2> This is some fairly rough feedback, but:

First, I'd like to simply mention that privacy and security are two different but very important things.

The difference is that while your severs may be "secure" from hackers, if you do not take care of data or user privacy people within may have access to sensitive data. It is important to maintain a high threshold for potentially sensitive data.

Some applications that pose privacy risks are Dropbox or Google Drive. Neither encrypts your data, but it is secured and kept private over-the-wire via SSL 256-bit encryption. It is true that both Dropbox and Google have access to your files, but they maintain a privacy policy and hopefully internal policies and systems to prevent just anyone from gaining access to your documents.

Network security in applications is fairly standard, nowadays the Internet can handle SSL pretty well, and with SPDY picking up adoption there is no reason to not enforce SSL for all connections to an applications.

Application security comes in a few ways. As a developer, you want to protect your IP, give the user good performance, but make it hard for jerks (yes, just jerks) from removing any DRM/licencing/registration processes you may have on applications. These types of things are common on mobile apps, it is easy to find re-released mobile apps for Android and iOS devices online if you know what to search or a good repository for it. Application security comes in the shape here that you need to enforce a licencing system that works for you. Many pieces of software out there assist with with, so you may not want to reinvent the wheel, but adding some custom processes here usually results in a good solution until someone with some knowledge has some free time and doesn't want to spend money.

Application privacy is important on mobile and desktop applications as well. The user data you store usually is not as-at-risk as you think, and many developers ignore proper processes as "it's up to the user to keep their device safe." Banks obviously do not feel that way, luckily. Games probably shouldn't bother. Social apps might want to step it up though. If you lose your device a lot of data is available from social apps and applications should simply should have processes to fix this. Twitter and Facebook allow users to do this remotely by rejecting/revoking an application's access to your data, but applications often store data on devices for offline viewing. Therefore this data should would be focus for a developer's concerns.

Encrypting user is a good idea, but is hard to implement unless the team is good with security. Encryption also comes in many levels. It's a very good idea to encrypt your server hard drives or databases, this prevents a lot of low-level attacks onto your system. Key management is therefore also important, and is is where things will get complicated. Encryption is also important for user-entered data however, beyond just encrypting your databases. Because database-encryption is slow, it usually isn't a good idea anyway. Therefore instead of doing that, you should just encrypt the user- entered data that is sensitive.

Network security is unknown to most web developers, who believe that throwing an SSL certificate up makes their applications secure. Obviously, as I mentioned, this helps. However network security comes in many other ways. Applications hosted on shared servers, switch servers. There are so many security risks in shared servers that attempting to control it is not worth the time. This does not include VPS systems however, assuming you are the only root/sudo users authorized. On whatever system you are on, you need to enforce a whitelisting firewall. Web servers should never use a blacklist for this. Most web servers only need a few ports open, so only open those. It's also common practice to leave SSH open, and a lot of people believe that by switching the default port it's magically okay to do so. It's not. Port scanners exist, and are easy to use. Your SSH should only allow connections from authorized networks, ESPECIALLY ON PRODUCTION machines. Get a VPN, remote desktop to your home and then SSH, or tunnel through a development machine. This goes the same for a lot of other services, FTP is another major one people will leave open, which on some instances allows anonymous by default. I've also heard of companies leaving MySQL remote ports open and that makes it exceptionally easy to bruteforce as many people use rather small passwords for databases. So another point there, make sure your database password is not so simple.

Operations/company policies should hold user privacy to the level decided by the company. I wish it was the highest priority for every company, but honestly, facing the through is that it's not. Every company should however figure out where user privacy stands and how important it is to them. This is generally done when setting up a privacy policy. In general, you should never share (or sell [personal opinion]) user data, give access to all colleagues, keep admin systems open for hackers to attempt to gain access to, allow all colleagues to have admin access to admin consoles, share admin logins with colleagues. A lot of small companies, especially startups, give full access to everyone to make it more open. This is extremely dumb. That is just the truth about it. Admin consoles are dangerous tools that should only be accessed lightly. This is of course different from reporting tools, which are used by business operations, marketing, etc. Admin tools can see, add, remove, modify user data and system settings. These should always be restricted on production machines. While it is often important to run SQL or database queries against production data, it is also bad practice to do so on production. Therefore you should setup a staging machine to keep a copy of production data allowing for proper testing. Assuming you keep user data encrypted properly, there is no risk, assuming it's like most software and there is no encryption beyond a secure hash to a password you should also consider proper privacy policies for your company. Sometimes removing certain data from a few tables is the best way to go, other times it's to have all production-staged queries run by a DBA who is aware of the company's privacy policies.

There is a lot more worth adding here, but your best bet is to figure out the team's stance on privacy and security and their knowledge about it. A lot of web developers assume the only aspect to security is cross site scripting (XSS), Clickjacking, sql injections, and cross-site request forgery (CSRF). This is extremely far from the truth. Most security advisers suggest that the biggest security risks are from within a company. It is extremely important to fight against outside hackers of course, but it's important to realize that security is more than just stranger-danger.

</comment><comment><USER3> I think for me this boils down to 'Unknown unknowns' First I need to have a high level overview of all the different areas that are impacted by security. Then, I need to know which ones are 'mission critical' so to say. Once I kind of know the big picture, and where I should focus my efforts first, I can go and learn by myself and then come to you when I hit bumps in my understanding.

For example, I am trying right now to build my first web app. I know certain 'things' eg don't store user passwords in plain text, don't try to build my own crypto solutions etc. But I have no idea of what possible attack vectors exist, which ones are critical, which ones are covered by using best practices, good frameworks etc. In other words, I have no idea where to start, literally because I have no idea! I am currently going through the matasano challenges, but I can't (at the moment as I have just gotten the first set of challenges) for the life of me see how I should apply this new knowledge to building a web app.

Regarding your question, I see you have maybe already outlined the sections of your high level overview presentation: 1: physical 2: network 3: application 4: operations 5: business risk management

But in all honesty, I really don't even know enough to answer you: What do I wish I knew? Because I didn't even think about those 5 areas even.</comment>


Mike Monteiro | F*ck You. Pay Me. - <AUTHOR> http://vimeo.com/22053820

<comment><USER2> Ah yes, an old friend. Here is the submission that has lots of discussion:

[https://news.ycombinator.com/item?id=2450424](https://news.ycombinator.com/item?id=2450424)

That's old enough that comments are closed, so if you want to add anything you'll need to do it here.

There are other submissions, none of which have significant discussion:

[https://news.ycombinator.com/item?id=2843893](https://news.ycombinator.com/item?id=2843893)

[https://news.ycombinator.com/item?id=6392471](https://news.ycombinator.com/item?id=6392471)

[https://news.ycombinator.com/item?id=2432213](https://news.ycombinator.com/item?id=2432213)

[https://news.ycombinator.com/item?id=2892712](https://news.ycombinator.com/item?id=2892712)

[https://news.ycombinator.com/item?id=6271778](https://news.ycombinator.com/item?id=6271778)

[https://news.ycombinator.com/item?id=3854847](https://news.ycombinator.com/item?id=3854847)

[https://news.ycombinator.com/item?id=5685840](https://news.ycombinator.com/item?id=5685840)

[https://news.ycombinator.com/item?id=2422396](https://news.ycombinator.com/item?id=2422396)

[https://news.ycombinator.com/item?id=4485328](https://news.ycombinator.com/item?id=4485328)

<comment><AUTHOR> Ok. Thank you and I'm sorry for the repost ;)

<comment><USER2> No need to be sorry. Many articles are posted, sometimes again and again, and the point is not necessarily that it shouldn't be done, but more, that previous submissions will have useful and/or interesting discussions.

The very fact that it's been submitted so many times simply says that it is an issue of relevance to the HN audience - you just might not get the discussion and votes you expect.</comment></comment></comment>


Death in the Sahara: An Ill-Fated Attempt to Reach Fortress Europe - <AUTHOR> http://www.spiegel.de/international/world/tragedy-in-sahara-desert-as-refugees-aim-for-european-union-a-997164.html

<comment><USER2> Do richer nations have an obligation to help improve poorer nations?

I think the answer is yes, but we've been pretty terrible at it so far.

<comment><USER3> Why?

<comment><USER4> Let's reformulate the question: "Do (capable) people have an obligation to help other people (which are maybe less capable or just capable in other ways)?" You don't have to answer that. On a smaller social scale we all have been helped, merely by the fact that we had living conditions, like having warmth and not having each of us to reinvent the fire for that, or benefiting from security for not having to fear all the time for our survival in a hostile environment, and so and so on. Your question won't occur any more wen we'll extend a little bit what we consider "we" to include the entire human race. We're all humans, right?

P.S.: I'm not assigning blame.</comment></comment></comment>


A Billion Taxi Rides in PostgreSQL - <AUTHOR> http://tech.marksblogg.com/billion-nyc-taxi-rides-postgresql.html <comment><USER2> > PostgreSQL stores each record, regardless of attributes, in an 8K block of > data (excluding TOAST fields and indices) on the disk. If you have a table > with 5 columns of integers they will use 8K of disk space for each row, not > 20 bytes.

This is wrong. Postgres uses 8KB blocks for heap data by default, but you can (and typically will) have multiple rows in a single page.

</comment><comment><USER3> "PostgreSQL stores each record, regardless of attributes, in an 8K block of data (excluding TOAST fields and indices) on the disk. If you have a table with 5 columns of integers they will use 8K of disk space for each row, not 20 bytes."

Uh, no. I think you're confusing tuples and pages. You can have many (many) tuples in a single page.

</comment><comment><USER4> How many taxi drivers using domain names ending in ".taxi": any idea?</comment>


Chinese scientists turn copper into 'gold' - <AUTHOR> https://www.scmp.com/news/china/science/article/2179209/chinese-scientists-turn-copper-gold <comment><AUTHOR> Similar post was already shared: [https://news.ycombinator.com/item?id=18762435](https://news.ycombinator.com/item?id=18762435)</comment>