Ask HN: What book did you use to teach your children math? - <AUTHOR> This question is obviously for the ones who either homeschooled their kids, or who did some teaching at home besides the school curriculum. I'd like to get some suggestions, opinions, etc. Thanks in advance! <comment><USER2> Khan academy is a great resource for your child to learn math. It was actually started with the realization that kids like to learn at there own pace, not being waited on by a tutor or teacher for them to understand the subject.

<comment><AUTHOR> At what age is it appropriate to begin Khan Academy's math content?

<comment><USER3> I think any age you are comfortable with. My son's school just started using Khan Academy as a supplement. He is in second grade, but third grade math. He really enjoys it, as do I.

</comment></comment></comment><comment><USER4> In 1993 my wife and I had a son, and we decided to homeschool him. I took responsibility for my son's mathematics education. I started by collecting hundreds of used math books (and some new ones), and then I identified the best of them to use as textbooks. I discovered that most of the books were of very low quality, and that only a few of them seemed to be any good. I did not realize until my son was in college that the reason the "good" books were good was because they were based on formal mathematics.

My son did not have any noticeable talent for mathematics when he first started learning it. In fact, he was not very good at math at all. I couldn't directly teach him math because I did not understand it very well at that time, so I had him work through some of the math books I set aside. Before he went to college, he worked through one "Saxon Math" arithmetic book, one book titled "How to Think Like a Mathematician" by Kevin Houston (which dealt with how to do proofs), and a book titled "Fundamental Mathematics" fourth edition by Wade and Taylor (which was based on 1960s New Math). Around a third of the way through the fundamental mathematics book he apparently saw how formal mathematics worked because he started being able to do mathematics quickly, accurately, and with confidence. He did not like math very much up to this point, but as soon as he was able to do math, he began to like it more and more.

Before college, my son never took even one math test. When he entered college, he majored in mathematics and physics. He was easily able to do all of the work in the mathematics and physics courses he took. This past spring he graduated with a GPA of 3.9.

Since 2008 I have been developing open source mathematics software that students can use to learn how mathematics works at a deep level. Here are some examples of what I have created so far:

[http://patternmatics.org/test/expression_structure.html](http://patternmatics.org/test/expression_structure.html) [http://patternmatics.org/](http://patternmatics.org/) [https://www.youtube.com/watch?v=kYtsQ_PczlY](https://www.youtube.com/watch?v=kYtsQ_PczlY) [http://www.mathpiper.org/](http://www.mathpiper.org/)

The last link is to an education-oriented computer algebra system. If you (or anyone else) is interested in learning more about this software and my thoughts on mathematics education, feel free to ask questions about it on the MathPiper developer list.

</comment><comment><USER5> _Maths for Mums and Dads_ :

[http://www.amazon.co.uk/Maths-Mums-Dads-Mike- Askew/dp/022408...](http://www.amazon.co.uk/Maths-Mums-Dads-Mike- Askew/dp/0224086359/)

[http://www.amazon.com/Maths-Mums-Dads-Mike- Askew/dp/02240863...](http://www.amazon.com/Maths-Mums-Dads-Mike- Askew/dp/0224086359/)

 _The Number Devil_ is often recommended:

[http://www.amazon.co.uk/Number-Devil-Mathematical- Adventure/...](http://www.amazon.co.uk/Number-Devil-Mathematical- Adventure/dp/0805062998/)

[http://www.amazon.com/Number-Devil-Mathematical- Adventure/dp...](http://www.amazon.com/Number-Devil-Mathematical- Adventure/dp/0805062998/)

How young are the children? What you can do for very young children is get some small stones and paint numbers and letters on them (use child friendly paint, obviously) and then use a toy dump truck and toy loader to move them around, and start recognising the numbers and letters, and start very simple spelling and arithmetic. Or you can paint numbers onto toy cars and use paint numbers onto a car park.

Cuisenaire rods are fun and useful.

[http://www.amazon.co.uk/Legler-Multiplication-Sticks- Educati...](http://www.amazon.co.uk/Legler-Multiplication-Sticks-Educational- Toy/dp/B00074U7SO)

Sometimes they come with books and you probably want to ignore most of the book. (Because knowing that green + red = blue is not useful.)

You can bulk buy dice. Chessex sometimes sell "pound of dice", and these are lovely tactile clicky clacky things. You can use these for games or rewards.

</comment><comment><USER6> I started with this one [http://www.amazon.com/Teach-Your-Gentle-Revolution- Series/dp...](http://www.amazon.com/Teach-Your-Gentle-Revolution- Series/dp/075700184X) I liked the dots concept. My daughter is only 2 but she can count to 40 in English and 20 in French. She can do basic addition using the counting method.

</comment><comment><USER7> We used Singapore Math and really liked it. I think of it as having all the good parts of Common Core (an emphasis on abstract thought) but without all of the crazy parts.

<comment><AUTHOR> How old was your child when you started it?

</comment></comment><comment><USER8> We like the "Life of Fred" series.

[http://lifeoffredmath.com/](http://lifeoffredmath.com/)

<comment><AUTHOR> Didn't know about this one. Seems like the storytelling aspect is pretty good. How long have you used it for?

<comment><USER8> Um... several years, but I'm not sure how many. Or, all the way from fractions up to trig. It's quirky, but the content is solid.

</comment></comment></comment><comment><USER9> it doesn't matter. at the basic level, solved domain -- all that matters is that they do problems</comment>


Really Simple Home – Killing decision paralysis, one product at a time - <AUTHOR> http://reallysimplehome.com

<comment><USER2> USD$60 (£39) for a pair of scissors? Yes, that's definitely cured my decision paralysis. I'll choose the pair at Target for USD$3.99, thank you.</comment>


Ask HN: Let users wreak their own havoc? - <AUTHOR>

Have you ever written a webapp where a more sophisticated end-user could basically edit the DOM and submit some invalid data?
I'm curious how far other developers go to prevent users from "wreaking their own havoc," as a friend of mine called it, as long as it doesn't pose any security threat.
For example, I'm writing an app that integrates with an API. I have a form where I take an API key. Based on that API key, there is a selection of entity IDs that they are supposed to choose from (pulled via the API).
Any non-malicious user wouldn't ever have a chance to enter invalid data. But a potentially malicious user might edit the DOM and enter an ID they don't have permission to access with the given API key.
Of course, the API permission checks won't allow for any future API calls, and the app basically won't work. I'm not for cutting corners, but I also don't want to replicate a bunch of validation checks client-side for users who are trying to game the system.
Thoughts? <comment><USER2> Do it right, and use proper validation on both the client-side and the server- side.

<comment><AUTHOR> Thanks - I know. I think there's always the possibility that the 'malicious' user in question could edit db/configuration files anyway, but it's definitely the correct thing to do.</comment></comment>


Burger King said to be launching its own cryptocurrency, the WhopperCoin - <AUTHOR> https://munchies.vice.com/en_us/article/433qy3/burger-king-is-allegedly-launching-its-own-cryptocurrency <comment><USER2> Is this actually a cryptocurrency? Kind of seems like its just a centralized legder of rewards points - which wouldn't make for a very interesting article.

Can users transfer whoppercoin between each other without hitting BK's servers? Can you mine whoppercoin? Are the coins secured with a private key?

<comment><USER2> Much better article here: [http://www.newsbtc.com/2017/08/23/burger-king- russia-launche...](http://www.newsbtc.com/2017/08/23/burger-king-russia- launches-whoppercoin-token-waves-platform/)

Not a cryptocurrency, but a cryptotoken on the Waves platform.

Seems like:

>Can users transfer whoppercoin between each other without hitting BK's servers?

yes

> Can you mine whoppercoin?

No

> Are the coins secured with a private key?

Yes

<comment><USER3> >> Can you mine whoppercoin? > No

Unless you count eating lots of whoppers as mining.

</comment></comment></comment><comment><USER3> For those who read only comments: this is only in Russia. And coin will be issued as a reward for buying whoppers, spendable on more whoppers. So, not that different than the "buy ten cups of coffee, get the eleventh free" type loyalty programs that have long existed at some US stores.

</comment><comment><USER4> So if someone hacks into my smartphone, they can steal a thousand hamburgers?

</comment><comment><USER5> Just a marketing gimmick.

<comment><USER6> 100%.

Without a novel need,there's zero reason to make your own token simply for payments. That part has been solved.

Why not take payment in ethereum alone instead? The transaction is processed by the exact same miners whether it's a token or not.

</comment></comment><comment><USER7> Cool. When is Canadian Tire going to issue its own cryptocurrency?

</comment><comment><USER8> *face-palm</comment>


Ask HN: Is my little tool doomed to obscurity? - <AUTHOR>

When people neglect to or decide not to renew their domain registrations, others will have a chance to get those domains. The list of expiring domains is of course very long, so I created a little script to help me find just the best ones. I used some dictionaries to match against, and for a while I also had some traffic data. I made a UI around this tool and posted it on the web. People seemed to like it and it got to the top pages of Digg, Reddit and del.icio.us. This was in December 2006. Just a few days after the initial burst of traffic, it was down to 100 visit per day, and is currently at 50 visits per day, making an incredible $5/month from AdSense.
I wanted to ask you smart devs whether there is anything you can think of that would make the tool more sticky, to turn the flatlined traffic into a growing trend? I find myself keeping the script somewhat operational, in hopes I would come up with something, but it's now been two years already and my mind is blank.
http://expired-domain.bemmu.com/ <comment><USER2> Here comes 5,000 of us again ;)

I think it's a great idea, I haven't tried your tool yet myself (it appears to be the ... Hacker News effect).

I agree with affiliate linking it to godaddy or something - I imagine you would make a lot of money. Also, get it it's own domain and brand it? Or get a web designer to do that for you if you are not into that. I don't really like subdomains, but that's just me.

You could also affiliate link to hosting websites if you don't already.

Another idea - how about make pages of common names? "Viagra" "Spyware" etc? Even hacker, java, whatever maybe a separate page for each of the top 500 searches

And then you could slap some Adsense ads on there. These pages would refresh every 24 hours, and I am sure people would bookmark them and/or subscribe for updates. This way if I was just browsing the site, I might click around between some pages.

The problem I see with advertising is that you can't target it very well ("domain searchers" is broad), but you could if you did it this way.

Even a "startup" tag would work, and you could then affiliate link to amazon to books with startups (or hand pick some for each tag)

These tags might eventually even rank in google, if you made enough of them (make one for every keyword searched, not just the top ones?). Not for spam purposes: for organization.

</comment><comment><USER3> Also, perhaps you could get a better domain name for your project with the tool? ;p

<comment><USER4> And change your web host to something like slice, it can't handle all our page visits and takes over 25 seconds to load.

This makes clicking anywhere on the site abhorrently slow too.

<comment><USER5> I concur.

Part of this (lack of) speed is that it is hosted in Finland, and running over Telia's network which is running abysmally slow.

New domain, host, and a little styling cleanup should do wonders.

</comment></comment></comment><comment><USER6> I like the tool -- definitely useful for people who are looking for good domains.

I am not a dev, but I have a few ideas:

\- Have a tool that limits the results by the number of characters in the domain

\- Quick links on the front page to results starting with each of the 26 letters of the alphabet

\- From a revenue standpoint, you could see if there is some sort of affiliate program with registrars, or work something out on your own with a partner firm.

\- Add some sort of custom news feed on the front page for domain-related news, SEO, etc.

<comment><USER7> > Have a tool that limits the results by the number of characters in the > domain

Currently achievable by editing the Regexp search, though admittedly not user- friendly:

      ^[^.]{4,8}[.](com)$

(Minimum 4, maximum 8 characters)

</comment></comment><comment><USER8> I would like to second (or third or whatever) the notion to get it a better domain name (perhaps one of those really good expiring ones). A hyphenated subdomain does not strike me as a good choice for a service that helps you find good domain names.

Also, I haven't had a chance to check it out because it's taking forever to load in my other tab, so I might be missing exactly what it does... but, how about some RSS feeds?

There we go it just loaded... I'm getting a MySQL error on line 105 of index.php.

Any chance you could do some data parsing to give me just the relavent whois info instead of dumping the whole entry into the page?

I do like the idea overall. Expect 51 visits per day now.

</comment><comment><USER9> Cool idea, but...

1\. It's very slow (HN effect?), speed it up 2\. Domain Name isn't great 3\. I can't jump to a letter via hyperlink 4\. I see something called Regex search...what is that? 5\. I'd like to see 100 or 500 names per page since there are 256,000+ pages

Honestly, you'll likely never make too much money off ads since the demographic of your audience is technical enough that they probably have an ad blocker installed or they have trained themselves not to click on ads.

Instead of clicking to the whois information, link to some registrar that has an affiliate program.

</comment><comment><USER3> Perhaps allow people to subscribe to a daily/weekly email with results matching their regexp?

That way people who find it and like it can be converted to return users? For instance I would be interested in any 2/3 letter domains that become available just for curiosity's sake.

</comment><comment><USER10> I think distribution is the key. You built a good product and ppl like it, that does not mean they will start using it. (Welcome to the real world, by the way).

To make it very clear, there are only 4 things you can do to tackle distribution.

1\. SEO - Will not work in your case because it typically works best were large amounts of original content is getting generated. (think ugc)

2\. SEM - Will again not work in your case because lifetime value of visitor is not much. Plus conversion rates are low with extremely low deal size. (Let me know if any of this is not clear).

3\. Widgets - dont think how this will work for you.

4\. Go B-to-B - I think this is the best option available for you right now. Essentially offer this as a service to hosting companies and domain registrars. Charge them a usage fees or an ROI rate. But this will require some real world busines development where the rules of the internet do not apply. If your tool is good, it could also be a nice little acquisition target.

<comment><USER10> Also anything else will NOT work. Bookmarking will definitely not. Noone uses bookmarks.

</comment></comment><comment><USER11> Are you sure that you don't violate the Whois TOS?

 _The compilation, repackaging, dissemination or other use of this Data is expressly prohibited without the prior written consent of VeriSign._

</comment><comment><USER12> Short answer... yes.

You have no built-in marketing, and no high-profit-per-user monetization to justify any expense to acquire visitors.

You could built a big SEO-net with themed lists of expiring domain names and go with a snapnames sort of model ("pay is $10 to monitor this domain name and we'll register it FOR FREE if it comes available")... That'd get you $10 and you could resell for a cheap registrar and make a nice margin if the names came available. You could even send them other names via email ("You're watching technology.com - here are 20 other similar domain names you might want to monitor/snatch up").

Still, commodity biz with little innovation ops, IMO.

</comment><comment><USER13> As other people have said you should be able to boost your income with affiliate offers. Pool, enom and snapnames all have programs. Where domains are registered with network solutions you may want to default to snapnames. For all other domains try some A/B testing and go with whatever pays the most.

It has been suggested that you add in link counts. My understanding is that the search engines, at least google, tries to discount links received prior to a change in ownership so I'm not sure this would be useful from a SEO standpoint. If you're interested in natural clickthroughs then it may also make sense to add in alexa/compete traffic stats.

The regexp gives a lot of power but many people have problems constructing them. I don't suppose there is a WYSIWYG editor for regexp is there? I would certainly take that form out to a page of its own and add a cheatsheet. I really don't think linking out to wikipedia is the right solution. Provide your users exactly what they need and no more.

You need some way of encouraging users to return. Subscription to a regexp search has been suggested. Weekly featured domain might also work. Email and rss would be good. Might also be useful to have a tell a friend function though the audience is probably wrong for this to work.

It would be good to be able to construct more complex sorts. Deleted and part of speech for example.

</comment><comment><USER14> Your problem is simple: people who do this have their own tools, have auction sites, have plans ion palce for years, all sorts of things.

Basically, your pitching a spoon to dig a hole, when the problem is solved better by an Earth mover.

Now, that isn't all bad, because noobies are better ad clickers anyway, but I doubt the tool would ever get much widespread usage (sorry!), and the effort to make it so is not going to be worth the return.

</comment><comment><USER15> Maybe if everyone on HN that like it bookmarks it.

I think you've highlight the core issue yourself though. You approached us and got some interest. Unless you engage with communities getting love back is unlikely.

You should be actively looking for people with this problem and giving them the solution. The more you do, the more it will spread until it's self- sustaining.

</comment><comment><USER15> Maybe if everyone on HN that like it bookmarks it.

I think you've highlight the core issue yourself though. You approached us and got some interest. Unless you engage with communities getting love back is unlikely.

You should be actively looking for people with this problem and giving them the solution. The more you do, the more it will spread until it's self- sustaining.

</comment><comment><USER16> I get lots of nasty mysql errors when I open the link. Make sure error_reporting is set to 0 and that you log errors to a file, which can be done via Apache (or your choice of httpd server).

Because of the mysql errors I cannot use your application either so I'll hold judgement on actual functionality for now.

<comment><USER16> They've cleared up now but make sure you turn visible error_reporting off, no excuses. You should also look into better error trapping and handling.

On another technical aspect I notice you're passing regexes via GET. Don't - setup an array of regexes with named keys (e.g. default => ^[^.]+[.](com)$) - I'm about to test to see how much damage I could theoretically do (without too much effect if possible). I hope you're not using that in an SQL statement.

Edit: Ah didn't notice it was a feature as such - while it's a pwoerful feature it's not very user-friendly. Perhaps create a search form that works similarly?

Issues aside it looks like an interesting tool - an additional sort could be to pick up domains that are single dictionary words, and then further sort those by number of syllables.

</comment></comment><comment><USER17> How about making the search more user friendly by offering a simpler search option in addition to the regexp search?

Many potential users may struggle to figure out regexps.

</comment><comment><USER18> Add a yahoo link count for each domain name so you know how many links are already pointing to the domain name.

</comment><comment><USER19> available according to whois on namecheap:

goodlookingnames com

thenameforme com

namesnomsg com

</comment><comment><USER20> sounds like a service that people would pay for

start charging for it, or at the very least make clicking on the domains take you to a godaddy affiliate link or something

<comment><AUTHOR> Yes, I used to use an affiliate program until it was discontinued. I think it was 10x more profitable then. The only registrars people can really use to register expiring domains are registrars specialized in that, and currently none of them have an affiliate program.

<comment><USER21> Maybe contact them directly and see if they'd be willing to set something up.

</comment></comment></comment><comment><USER22> How about NEW domain names as opposed to expiring ones? See <http://hotNameList.com>

</comment><comment><USER9> That's what he said!

</comment><comment><USER23> Can you mount it on the front pages of news sites that target people who'd use something like this? I was struck by how important Google's placement in all firefox browsers is. maybe you could get placement on tech news sites as a fun utility?

</comment><comment><USER24> Your little tool doesn't have to be doomed to obscurity:

<http://tinyurl.com/6aybvs></comment>


Ask HN: How often do you swap between languages ? - <AUTHOR>

I was wondering how often people jump between various languages in a day and how it affects productivity.
In my case, I use Perl at work. I then jump to PHP, Python, and Javascript at home for personal projects almost on a daily basis. As an example, I have to google how to compute the length of an array if its :
1. strlen(myString)
2. myString.length()
3. myString.length
NB: I generally use Emacs for writing code in *nix/Mac and Notepad++ if on a Win Box. <comment><USER2> I use Java and Flex throughout the day and switch to Python and Objective C in the evening. I agree that I've reached my limit on storing the massive standard libraries these languages have in my head, but I think use of IDEs in the past has made this worse for me (I got lazy).

I'm back to using Emacs almost exclusively in an attempt to remember the APIs. I know I'll take an early hit for it, but I'm hoping I'll make up for it.

</comment><comment><USER3> I use Groovy and Java at school; PHP and Python at work; and finally Smalltalk and C at home.

I have recently switched from all emacs, to TextMate at school and home, and emacs at work (although I'm trying to see if JEdit will work better).

</comment><comment><USER4> Ruby and Javascript at work.

Otherwise, I'm playing around with Lua, Ruby, Erlang, and Python.

</comment><comment><USER5> i use about 5 languages at work, and 2 or 3 more at home. you get used to it, really. a good IDE helps in the case of forgetting something like how to find length.</comment>


ScrAPIr: Making Web Data APIs Accessible to Everyone - <AUTHOR> http://www.mit.edu/~tarfah/webapidata/ <comment><AUTHOR> I thought this was pretty clever: since most websites have nice APIs on the backend, what if they were exposed directly to the user? There are some demo videos on the press announcement: [https://www.csail.mit.edu/news/searching- websites-way-you-wa...](https://www.csail.mit.edu/news/searching-websites-way- you-want)</comment>


Texas court upholds "do it on a computer" check-cashing patent - <AUTHOR> https://arstechnica.com/tech-policy/2019/10/texas-court-upholds-do-it-on-a-computer-check-cashing-patent/ <comment><USER2> Of course a Texas court upheld a bogus patent. It's a Texas court. It's what they do. Patent trolls _love_ taking their cases to Texas because Texas courts routinely side with software patent holders and effectively ignore judicial precedent at higher levels (which is exactly what happened here).

<comment><USER3> >It's a Texas court.

It's a _US Federal_ circuit court that just happens to be in Texas. The federal circuit judges are appointed by the President, not Texas.

> Texas courts routinely side with software patent holders

Again, wrong. It's the federal courts in the Eastern District of Texas that are the problem in particular. Not any Texas court that has meaningful de jure associations to the state itself.</comment></comment>


Companies consider abandoning open office layouts to prevent disease spread - <AUTHOR> https://www.nytimes.com/2020/05/04/health/coronavirus-office-makeover.html <comment><USER2> The best way to prevent spreading diseases at the office is to not require your employees to go to the office - assuming WFH is compatible with the company's business.

I work at a FAANG company which was aggressively opposed to WFH before the covid-19 crisis. As matter of fact, I recently changed teams within said company and during the informational interview I asked about the team's policy on WFH - the answer was that "our team has a strong 'collaborative in-the- office' culture, so we don't encourage WFH"

I am not kidding, we're talking about one of the most advanced companies in history and they required domestic travel+hotel for trivial half-day, mostly passive interview training that could have been done _easily_ over teleconference, that's how much this company values physical presence.

Fast forward a few months, everybody is WFH in the company and the sky hasn't fallen. Actually, my productivity vastly increased because I'm fortunate to have a solid WFH environment at home (despite kids/wife around).

While I'm not proposing mandatory WFH for tech companies, neither saying that it works for everybody, I believe our top companies could lead and finally allow people who demonstrate that they can be productive at home to just stay home - permanently.

<comment><USER3> This is a problem with incompetent managers. They failed to understand the different between productivity and sitting.

Last company I worked for, the CEO said to me he doesn't care where anyone work as long as the work get done well. However, this was not the case with my own manager. He micro managed everything. He had an office manager sitting with the engineers reporting to him multiple times a day on if the engineers were sitting on the desk. You can feel you are being watch the moment you step into the office. It was an absolute shit place to work for.

<comment><USER4> > He micro managed everything. He had an office manager sitting with the > engineers reporting to him multiple times a day on if the engineers were > sitting on the desk.

I _really_ related to this in my last role. It's the butts-in-chairs method vs output because let's be real... most of the people promoted to middle- management can't measure actual output.

I've always been on the edge of being a manager vs. being IC and the times I've bled over into management I have this style: you're expected to be here early by 30 minutes for meetings, and if you wanna leave directly after to go work from your home office I could care less. I expect workers to be highly available via chat and phone during normal business hours (adjusted to the timezone), and generally flexible if something comes up where I need 'em in the mothership.

To measure output and success, whelp I just get on the corporate GitLab and read everyone's commits daily. Not only do I learn a TON working with solid talent... I also know who's jerkin' me around. Does this work for every WFH- type employee? Nope. Managing devs gives you a ton of black-and-white paper trails to ensure people are working the right direction.

In contrast, throughout my IC career none of my managers have managed ME this way which blows my mind. I know I'm not the most talented leader but I don't understand why dev management doesn't look at real metrics to gauge success outside of "I don't know how to read code"... =|

The way I managed also bought loyalty... like _a lot_ of loyalty. When you get out of the way of people's lives and say, "I'm willing to make this career work with you as a person" you get an insane amount of forgiveness for being a poop manager in other areas.

Did people take advantage of me giving them this slack? Yep. Did I fire 'em for poor output? Yep - at will state sucka. IMO you'll get people taking advantage of the system regardless of how you wanna lead so the best way to hedge that risk is looking at metrics + engaging consistently with your team. Bad apples tend to stick out in a few months and you just gotta learn to fire fast to maintain the integrity of the team vs pumping your staff numbers.

<comment> james-mcelwain I've often been tempted to show my less-technical manager our commit log, but have always avoided it because I can't see any way it wouldn't turn into some stupid game about commits and lines of code changed.

<comment><USER4> I'd say about 70-80% of managers I've had couldn't build or work on the product that they're tasked with managing. And... I resent that.

The truth is you need near-100% understanding of the code going into the product to really gauge someone's participation accurately. Looking at LOC, # of commits, etc. is all fluid so while they describe properties of the story, they're not the actual story itself.

Also, there's up and down weeks. I've watched my top performers have poop weeks where they've only been able to crank out a couple of small features, or maybe just resolved one issue, etc. I feel like if micro-managers saw this they'd put the hurt on em... for me it literally never came up because within 1-2 weeks they'd be back on the rails. I was always like "huh - musta been some human stuff." Or, heck... sometimes I could tell they just moved a bit slower on more mundane tasks. When I put myself in a position to relate to that I find that I have the same lulls, lack of motivation for mundane work, etc.

People NOT getting back on the rails after 1-2 weeks of meh was the exception! I also felt like I could demand more of my team during the 2-3 crank-it-out periods that inevitably occurred throughout the year because I had respected their time leading up to that... IDK.

All-in-all if specs were being respected, code was clean/reasonably PR'd, deadlines were hit, and meetings were well prep'd for + attended I felt that we were being successful.

<comment><USER5> Wasnt there a story about a graybeard who, upon being turned into a gamafied LOC programmer, ended up changing 2 lines and removing 2000?

He put -1998 lines on his daily email?

And I think that hits to the core of Goodhart's law:

""When a measure becomes a target, it ceases to be a good measure.""

<comment><USER6> You might be thinking of [https://www.folklore.org/StoryView.py?story=Negative_2000_Li...](https://www.folklore.org/StoryView.py?story=Negative_2000_Lines_Of_Code.txt)

<comment><USER5> Indeed! That's it :)

Thank you for finding it.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> My, how the pendulum swings!

I'm firmly in the camp of hating open office plans. My first job out of college making $50k per year in Washington DC, I had my own office.

It was all downhill from there.

In my career (I'm 45 now), there is literally a direct negative correlation between how much money I make and the quality of my office surroundings (specifically, the privacy and quiet all go down as my pay goes up).

I used to rail against it but I figured that's how the world works and always insisted on enough money to make up for the crappy office space.

I would be THRILLED if COVID reverses this (IMO) awful trend.

However, I do not have my hopes up.

<comment><USER8> Open floor plans make concentration nearly impossible. Headphones and music is a must. It's also deeply unsettling to have people walking behind you 24/7\. I think human evolution makes you not happy about this.

A coworker of mine left for a company where all employees have offices and according to him the gain in productivity was wild.

<comment><USER9> Having intentional collaborative workspaces, while maintaining private space for concentration or just personal retreat, is optimal. Forced collaboration is suboptimal.

<comment><USER10> Private officies are perfect for collaboration. There is no need to schedule meeting rooms. Just talk in your office.

<comment><USER11> Yes. I worked at a company for many years that was offices (mostly for managers) and cubicles. Collaboration was fine. Culture was open door unless you specifically didn't want to be disturbed/overheard for some reason. I imagine it's different at other places but private office shouldn't be equated to private office with always shut door.

</comment></comment></comment></comment></comment><comment><USER12> Now this is interesting.

All of the reasons provided for open plan offices have been disingenuous; the reason why open plan offices are a thing is that it drastically lowers the land cost per employee. This is why they were popularized in NYC and SF; two cities with famously high land costs.

But of course, abandoning the open plan office is expensive. Companies will need more space, driving up the cost per employee. One can't help but wonder if this'll push for more permanently remote positions.

<comment><USER13> If that were the only reason, then cubicles would be equally popular. For some reason companies want floor plans that do not allow your back to the wall, no partitions higher than sitting shoulder level, minimal sound or sight blocks. I think there must be some psychological effect they're taking advantage of when workers feel like they're being constantly watched from all angles.

<comment><USER14> Open office seems to me to be even more space-efficient than cubicles. In an open office, I have 2-4 coworkers within arms reach. In a cubicle, everyone at least has a few feet of "bubble" in their cube.

</comment></comment></comment><comment><USER15> I'm always amazed that in discussions about offices vs open floor plans there is no mention of sunlight. To me offices buildings are always associated with 24h fluorescent-only lights for all but the best offices (usually top managers/senior engineers), whereas most open offices have ample sunlight, regardless of whether you have a sit by the window or are working in the center.

Not to say that there aren't all sorts of disadvantages to open offices, but I still feel sunlight counts for a lot.

<comment><USER16> I would echo the sibling comment (save_ferris) that in many places open offices do not encourage sunlight - especially those places where the offices are on the outer perimeter (capturing the sunlight) and the interior is stuck with fluorescent lighting (a previous experience of mine).

To add to your sunlight comment, though, is I also rarely, if ever, see notes about ventilation. Converting an open-space office into a private-space office (or potentially even cubicles) is non-trivial as far as ventilation is concerned. Not that I think it is an excuse for an open office, but it isn't as simple as throwing up some temporary walls in an open space.

Do I believe it is worth it? yes. Would most places see the work required and want to deal with the hassle of coordinating everything with the building owner to get the work done? probably not.

</comment></comment><comment><USER17> Unless you have self washing surfaces, filtered air systems and a single office for each of the employees I don't see how this would help for something like the current virus. They're all most likely going to eat in the same areas, use the same bathrooms, doors, elevators, meeting rooms, use public transports to come to the office, &c.

You know what's a good way to prevent disease spread ? Paid sick leaves

<comment><USER18> 9th paragraph:

> Other research shows that one of the best ways to reduce transmission in the > workplace is to provide paid sick leave that encourages ill employees to > stay home.

</comment></comment><comment><USER19> Even without COVID-19 sickness gets passed around like crazy in open layouts

<comment><USER20> Yes but that's not their concern. It never was. We can now clearly see what the threshold is for management making such decisions. Workers complaining of work conditions? Research showing decreased productivity? Nope. Not going to do anything until there's live video on the 5 o'clock news showing body bags being loaded onto refrigerator trucks.

The saying goes, "Safety regulations are written in blood". This is one of the many reasons unions are useful even if you make a great salary. It gives you someone on site whose job is to look out for you, and it gives you a lever with which to institute necessary workplace changes.

</comment></comment><comment><USER21> It's amazing that it takes a deadly global pandemic for companies to finally abandon this very poor organizational tactic, not years of reduced productivity, increased worker stress, and (in environments where it wouldn't endanger workers' careers) constant complaints.

<comment><USER4> It was never about productivity or the worker. It's a well studied thing that there's a steep drop in productivity when moving from closed-offices to open plans.

I think it's a foggy cloud of reasons this came to be such a fad, from cost savings in floorspace/etc., to managers wanting to micro-manage butts-in- chairs, to the cargo-cult-esque promotion of it, etc.

In America, color me "not surprised" that it takes something outstanding like COVID to move the needle in the corporate sector.

</comment></comment><comment><USER22> Open Office space never was smart except for saving rent. Open Office space causes more distractions lower productivity and less cooperation. Diseases spread more easily too.

The only good thing I can think of is startups where costs needs to be saved.

<comment><USER23> We call it Libre Office now, by the way ;)

To be honest, I think the true innovation is WFH. Bypass all these things and make a full-mixed city where folks can work without commuting and walk to their diner spots and everything. It's what they made the future look like in sci-fi. I can't wait.

Combine that with my personally highest desired innovation: work times. In California, the most beautiful time of day is right now morning to noon, and afternoon to evening. I want to be out. Fortunately, I _can_ be, but so many people are missing out on this.

With WFH will come a competitive advantage - the worktime shift. And we will live our best lives.

<comment><USER24> And this right here is why I've been working remotely with american companies while living in Asia. I can go, take advantage of the beautiful weather in the afternoon and hike or feel refreshed, then get to work until the middle of the night.

</comment></comment></comment><comment><USER25> > Some companies have begun mentioning a return to one of history's more > derided office-design concepts: the cubicle. There is talk also of the > cubicle's see-through cousin, known as the sneeze guard.

So we will replace open office layouts with transparent single person cubicles.

<comment><USER26> Why does it _have_ to be see-through, though? So the worst thing about open spaces — absolute lack of privacy — stays?

<comment><USER27> With see-through it is possible to increase density without it being obvious coffins. Instead - behold the cozy aquariums. So, yes it stays.

Anybody thinking/celebrating that we'll get less density because of covid are dreaming a nice dream:)

</comment></comment></comment><comment><USER28> I much prefer having a private area to work efficiently without distraction (rather minimal distraction) vs a large shared desk where the weakest attention-span "link" at the table would take everyone off task frequently.

</comment><comment><USER29> Any company large enough to track software engineer productivity is seeing an uptick in output.

If you're keeping score: open floor plans are quantifiably worse for productivity than global pandemics.

I miss my office. It had a couch and a door.

<comment><USER30> Very persuasive to use your manager's own metrics (sprint velocity, etc.) to show that you're more productive WFH.

</comment></comment><comment><USER31> We have a pretty optimal layout, imho. We have several "pods" which are an open 30'x30'x14' room that opens to the main corridor, which get divided into up to 7 cubes via 7' dividers (very modern and colorful, not the vertical carpets of yore). The center usually has whiteboards and chairs for collabs.

So you get interaction with coworkers, but can bury yourself in work readily (also everyone has noise cancelling headphones).

Kinda miss it, it's way nicer than my home office.

There's definitely way less structure now and I am suffering for it.

<comment><USER32> That sounds relatively fantastic. I interviewed with a few larger companies many years ago that had a similar thing. Each "pod" (or scrum team, or what have you) had an office with a door that closed, semi-private cubes within, their own collaboration space, and autonomy over much of their environment.

Interestingly, all of these companies ran outmoded spec and dev waterfall processes. And every truly agile place I've worked at or experienced has been everyone in an open room on each other's nerves. Weird correlation!

</comment></comment><comment><USER33> Why companies have open floor plan offices:

        * Reasons 1-9: it costs A LOT LESS than offices or cubes
        * Reason 10: Collaboration :)

</comment><comment><USER34> Better turn off the air con too.

<comment><USER35> I truly do not miss the HVAC at work, where the thermostat is controlled by a company in another city, and I have to layer up in winter clothes all summer, some of us wear coats and gloves at our desks in the summer, and then randomly the entire system dies, leaving us to suddenly roast in a building where none of the windows can be opened. Sometimes my supervisor has to leave her painfully frigidly cold office and go stand in the restroom (always far too warm) for a few minutes in order to thaw out.

<comment><USER36> And in the winter, 80F+ degrees, making sure to weaken the already weak systems people have in winter and ensuring that people get sick. The one job like that, I quit after two weeks, but not before getting the worst flu I've ever had as an adult. I'm sure this will work out wonderfully this winter with coronavirus.

Frankly, companies asking employees that can wfh to return before a vaccine or cure exists are nothing short of committing murder. I doubt anyone will stop them though. I've never had a job I was willing to die for and I'm certain I never will. Better fired on unemployment than dead.

</comment></comment></comment><comment><USER37> A friend of mine has furnished his garage, and is renting it out as a private working space in his neighborhood.

</comment><comment><USER38> Open office plans are so disrespectful of employees. It was always a brazen move to save money on commercial real estate. Not being able to poop because your building is overcrowded was maddening to the point that I contemplated revolt.

</comment><comment><USER39> Funny... for all the points against open office layouts that have been previously raised (and ignored), now it's infectious disease that has finally struck a cord against the office paradigm.

("Funny" in a cynical sense).

</comment><comment><USER40> There is no mention of the elevator. Until they solve this the open/closed floor isn't going to matter.

</comment><comment><USER41> Wow, if there was one good takeaway from this whole COVID-19 mess, getting rid of open office layouts would be grand.

Or at least having a hybrid of small pods of teams and a few larger meeting areas for less frequent, larger meetings. When not working remote.

</comment><comment><USER42> Are you in the same closed air-circulation? Is someone sick even without symptoms?

Well now someone else is sick. And they are going to get the next person sick.

Virus doesn't care what your office plan is, you are all in the same circulating air.

</comment><comment><USER43> I have seen movies from the 80's were each private office had a bathroom and often wondered if that was a real thing. Anyone who have worked a place with both a private office and bathroom?

<comment><USER44> Technically, I'm entering my ninth week of working at a place like this. It has its ups and downs, but overall I'm liking it.

<comment><USER43> Ha, didn't think of that, the same for me then. Not as much cocaine in mine as I had expected though.

</comment></comment></comment><comment><USER45> I hate open offices, but i think those aquariums might be even worse.

</comment><comment><USER46> So I was last in the office in early March. First it was a week of recommended WFH followed by a predictable shift to mandatory WFH but I'd already decided that NYC was not the place where I wanted to be when this all played out so I exiled myself.

I honestly don't know what going back to the office looks like at this point, both in timing and the logistics. The fact of the matter is that we have open plan layouts with minimal space per employee (basically a desk plus chair) because of cost. An office per employee simply doesn't scale for the size of the big tech companies if they want to have offices in coastal urban areas.

I haven't run the numbers on this but I'd guess it averages out at about 60sq ft per employee in the desk area and probably twice that once you factor in all the meeting rooms. It may even be as high as 150sq ft.

As an example since there are public numbers on this, Google's building on 111 8th Ave is, I believe, 2.1 million square feet of rentable space divided over 16 floors. Higher floors have smaller footprints so for the lower floors that's probably around 160,000 sq ft. I don't know the number of employees per floor but I believe it's around 1500 give or take so this would fit the estimate of 120-150sq ft per employee.

Google bought that building for $1.9B. It's probably appreciated some since then but probably not hugely, being commercial. Let's say it's $3B. That's a value of $1400/sq ft. Assume an 8% gross yield then 140sq ft of space costs ~$2M and has an opportunity cost of almost $160,000.

Doubling that space gets real expensive. Even if you're prepared to pay it, having room for the ~8000 employees you have gets impractical. 111 8th Ave is already one of the largest buildings in NYC (by rentable square feet). Google have already overflown to Chelsea Market and 85 10th Ave and probably more by now (I left ~3 years ago).

Social distancing is going to be a thing for the foreseeable future. People have this weirdly optimistic view that we can just develop a vaccine or an effective treatment for this. There are many diseases that have killed millions and been around for decades that still have no vaccine (eg HIV, malaria, dengue fever).

In fact, no coronavirus to date has had a vaccine developed for it.

It's unclear what will happen with Covid-19. will it mutate and become something you seasonally just "get" like the flu? We have flu vaccines but they're partially effective and the virus mutates such that you need a different vaccine every year.

Generally speaking, viruses tend to get less deadly over time (eg Spanish flu evolved into H1N1 eventually) but it doesn't seem like Covid-19 is particularly deadly now. You might point to the number of deaths in each country but the number of infections in almost all cases is underreported. Some don't even realize they've had it.

Or will herd immunity kick in at some point?

But I look at all this and wonder if I'll get back into the office _this year_.

Even when I do, I just don't think more space or private offices are in my future. I also don't foresee a WFH revolution. So it's going to be interesting to see how this plays out.

<comment><USER20> > The fact of the matter is that we have open plan layouts with minimal space > per employee (basically a desk plus chair) because of cost.

This claim is repeated in every HN post about open floor plans. I'm sure there are some cases where it's true (Manhattan!), but in every case where a manager forced _me_ into an open plan layout, I pushed back, and they admitted it wasn't really about the money.

<comment><USER12> Open plan offices started for cost reasons in areas with very high land cost, largely NYC and SF. However it was never stated as a cost cutting measure, instead it was dressed up as a "collaboration" tool. Of course since SF and NYC sets trends, tons of other companies have been cargo culting this layout, since that's how google does it.

Also, most managers don't actually know what their facility space costs. I don't.

<comment><USER47> This. The vast majority of line managers are very, very far removed from actual costs (and often, actual driving reasons too!).

Talk to an actual office space fit-out specialist to get real numbers. They'll tell you that individual offices are much more expensive than cubes.

</comment></comment></comment></comment><comment><USER48> consider?

</comment><comment><USER49> Use UV-C air cleaners to kill all airborne virus and bacteria in each closed office. Very inexpensive. Look for HEPA air cleaners.

Conference rooms, and lunchrooms can have a personal UV-C air cleaner quietly blowing sterile air at each face.

Closed offices are healthier and much more productive. Employees deserve the increased floor space cost - especially outside urban cores.</comment>


Toktumi Line2 has an answer for AT&T iPhone hang-ups - <AUTHOR> http://www.usatoday.com/tech/columnist/edwardbaig/2010-04-29-baig29_ST_N.htm?

<comment><AUTHOR> Love this app, can finally use my iPhone at home. Never had a dropped call on WiFi and the sound quality is great. I know there are a few portable personal WiFi devices out there. Any recommendations? When my AT&T contract is up I'm thinking of just using my iPhone with a WiFi device and drop AT&T completely.</comment>


How to use blockchain for supply chain management - <AUTHOR> https://www.devteam.space/blog/blockchain-for-supply-chain-management/ <comment><USER2> > The exciting thing about blockchain technology is that it acts as a > decentralized ledger that uses encryption to make it secure.

Is "hashing" encryption? You can't really do "validation" like the diagram says, either.

alexey: I know you wanna shill your website a bit, but you could have chosen a better article to do so with.

</comment><comment><USER3> Not the best article to describe the benefits of blockchain for supply chain management, but the point does get across.

Now, I'm aware that many people dismiss blockchain technology as a usable medium to store information (instead of your typical SQL database), but one clear advantage is that it's decentralized, which prevents a central authority from tampering the data. For supply chain management, that's not a necessary property, but when you consider product certifications (e.g. biological produce, sustainable whatever, etc.) and authenticity, then decentralization (and immutability) clearly become benefits. While I don't think it's okay to use a blockchain because it's the cool thing to do nowadays, it certainly got me thinking.

In December 2017, there was an E. coli outbreak in Canadian romaine lettuce, killing some people in the eastern provinces. Health agencies tried to identify the cause of the contamination, but they abandoned the investigation after a few weeks [1].

I stumbled upon Provenance.org a few weeks ago, and as part of a student project, some colleagues and I decided to develop a Provenance.org clone, mostly as an excuse to learn Ethereum smart contract development and the Solidity programming language (DApps and all that jazz). One challenge we're currently running into is about the granularity of the the product tracking: should a single box of Ritz crackers have its own identifier? Should the entire pallet have a single identifier? How about raw materials that combine to form an entirely new product? Or a pig that's split up into multiple parts for markets to sell?

We're looking to open source the project at the end of the term (around May), so if you're interested, reach out to me.

As previously stated, blockchain technology might not be the solution to everything right now, but it's definitely interesting and fun to experiment with.

[1] [https://www.canada.ca/en/public-health/services/public- healt...](https://www.canada.ca/en/public-health/services/public-health- notices/2017/public-health-notice-outbreak-e-coli-infections-linked-romaine- lettuce.html)

<comment> noah-kun Wouldn't the investigation into E. coli have been more fruitful if information were more centralized? Isn't it already decentralized, wasn't that the problem?

<comment><USER3> Interesting argument. The problem about this particular investigation (which I can only assume here) is that the available data did not offer relevant information about the tracking of the lettuce.

If the required information _did_ exist but wasn't accessible, then you are right in saying that the non-centralization of the data is a problem. I guess the problem then lies in the fact that information is siloed in different businesses. A solution to this could be the concept of federation, where all such businesses use an agreed-upon protocol/platform, but all can use the client of their choice.

<comment> noah-kun Thanks for the open-minded reply.

Can we push our imaginations further though? We are still thinking about the resources being distributed by businesses, for example. What about communes, central planning or automation, minus private enterprise altogether?

</comment></comment></comment></comment><comment><USER4> This is a really disingenuous submarine piece to sell consulting hours.

Blockchains are significantly more inefficient than traditional databases and open up unnecessary security holes if its using PoW or PoS.

Distributed databases with amend only and some sort of log (add a merkle tree and call it a blockchain™) would be more cost effective and efficient than any actual blockchain system.

</comment><comment><USER5> Is this satire?

</comment><comment><USER6> What did I just read? This is really poor quality

</comment><comment><USER7> Looks like blockchain is the new nosql. But is it webscale?!?</comment>


Intel Acquires Habana Labs for $2B - <AUTHOR> https://www.forbes.com/sites/moorinsights/2019/12/16/intel-acquires-habana-labs-for-2b/ <comment><USER2> With all the hyper scale providers building or launching their own inference chips, this seems untimely. If intel wants a return on that $2B, I think it will come down to how fast they can execute mass-production of these chips. Unless I have missed a distinct advantage here.</comment>


Shapeways (3D Printing Startup) Raises $5MM Series A from USV  - <AUTHOR> http://www.shapeways.com/blog/archives/595-Shapeways-raises-5M-and-opens-HQ-in-New-York.html

<comment><USER2> There is a relevant (albeit vague) U.S. bill in committee to establish a "National Fab Lab Network": <http://www.govtrack.us/congress/bill.xpd?bill=h111-6003>

</comment><comment><USER3> This is the future!!! I remember when I saw this website a year ago, and it seemed then that the majority of items would be purchased for only the price of the material used (could be mistaken about that). I can understand talented people who want to make a buck going away from that "business model".

But imagine if even a little of the "open source" culture rubs onto this community, prices could fall incredibly low for super interesting products. I can really see this taking off.

<comment><USER4> While I certainly don't mean to dampen your enthusiasm, it takes more than open source culture to get those prices to drop. This industry is an absolute minefield for intellectual property. Just like 2D printing, 3D printing manufacturers make roughly 70% of their cash from the sale of materials, and this means there's no incentive for them to drop.

Of course, this isn't stopping people from knocking them off for cents on the dollar, but still.

<comment><USER3> Yes but there is more than one reason to charge a lot for a product, one is the material used (which I don't expect to change much), but there are many others, such as creativity of design, utility, etc.

When you look at Shapeway's store you can see so much intricacy in some products. With a $10 block of plastic I can make a product that would otherwise sell for $100, now sell for $10.

<comment><USER4> Trust me, I'm totally on your side. Theres a reason this tech has been around since the 80s, but things like the MakerBot has only happened recently, that's all I'm saying.

<comment><USER5> The reason is that the software was always very difficult (and expensive)

People that had, and could drive, Solidworks weren't interested in making one- off bits of jewelry and the artists that were couldn't drive the CAD system.

</comment></comment></comment></comment></comment><comment><USER6> Wow. Everything is crazy expensive. $40 for a little plastic robot that doesn't move? Even if -I- had designed it, I wouldn't pay $40 for plastic printout of it.

<comment><USER4> Shapeways' prices are actually fairly competitive. 3D printing isn't cheap.

<comment><USER6> My point wasn't the 3D printing cost. Or about 3D printing in general. I know it can be really useful, and these would be good prices for those things.

My point was the objects available for sale. Like that robot. They don't make sense, especially for that price.

</comment></comment></comment><comment><USER4> Just woke up and saw this. Awesome. Congrats to Peter and everyone else at Shapeways, this is great!

This just made my space a lot more interesting. CloudFab doesn't exactly _compete_ with Shapeways, but when explaining what we do, we've had a lot of people be very skeptical on the whole mass customization market. Hopefully this makes people take it a bit more seriously.</comment>


What do you feel sucks the most when learning something new on the internet? - <AUTHOR>

Assuming you have time to learn something new. A new topic you know nothing about. Not to deepen your understanding of a topic.
And that it is by yourself, not classroom learning. That is, self-teaching. In the process of going:
From: "I want to learn X" (e.g. Spanish, Arduino, Rails, How to build a startup?, How to play guitar?) To: "This is the resource/link/blog/book I am going to use to learn"
What's your biggest frustration? What do you hate the most?
Would love to chat beyond here, DM (@rjgonzo) me if you want to chat some more later. <comment><USER2> The biggest problem for me always seems to be figuring out what I need to know, rather than finding the resources themselves. For instance, assume you want to learn how to make a simple web app, and have no experience or background in programming, CS, databases, etc. Figuring out where to start and how the puzzle fits together can be really daunting.

You start googling but can't figure out how it all fits together. Javascript, Ruby, Ajax, Python, Rails, Django, Flask, MySQL, heroku, html, css, jquery, bootstrap, appengine, aws, servers, browsers, APIs??? It takes some time to figure out what things even are when you are taking your first steps. Once you realize you pretty much need to know a bit of HTML to make a website, finding a suitable tutorial, while sometimes frustrating, isn't all that hard.

Most people here know how these technologies fit together, but as a beginner I didn't. It took some (frustrating) time to learn how the puzzle pieces fit together, what is optional, what is new, what is proven... etc.

This problem isn't isolated to programming. I think this is a big problem for a ton of self directed online learning. Lets say you convince yourself you would like to become the next Satriani on Guitar, but don't know what scales, triads, or chords are let alone how they are built. Should I concentrate on technique drills, songs, improvization, theory? I have met a huge amount of people who get very intimidated and end out just learning to play songs from guitar tabs, and never progress from a very superficial beginnner level.

Perhaps it is a result of people not wanting to dive in until they can put together a basic mental model of how things work. Regardless, the "roadmap to expertise" problem seems to be real and discouraging for people not willing to just power through it. Can teachers and Tutors be relpaced in providing the direction through the weeds? I'm not sure, but surely solving this problem could be lucrative.

<comment><AUTHOR> Awesome feedback! And I understand, my background is on computer engineering and even sometimes when starting to learn about something completely new that I had not done before (e.g. web-services/mobile), despite my previous knowledge or background, it can be frustrating. So, how could we fix this?

What was your process to figure it out? What did you search for? Where did you search it? Did you ask someone?

<comment><USER2> I have been thinking about this problem for a while, but I'm still not really sure how to solve it. I somewhat like the idea of a site with broad topics which narrow down into steps and tutorials, or links to tutorials. I'm not sure if this would really work.

I think I just read, googled, youtubed, and forumed my way out of the box. Surely this can't be the best way.

</comment></comment></comment><comment><USER3> 1) Best audio/video lectures on a topic, itunes u has some great lectures, but discoverability is awful. Close to impossible to find good cotent.

2) Find what I don't know from content which mostly covers stuff I already know. Normally when I'm reading something I probably know 90% of it already, but I have to read that 90% anyway to find out what that remaining 10% is.

<comment><AUTHOR> 1) Why is discoverability awful? How would you change/improve it?

2) So a tool/place that takes into consideration what you already know and gives you suggestions on what your next steps should be would help you on your learning process?

<comment><USER3> 1) Try it and see (pick a topic like "pyschology" or "linguistics" and try to find the best introductory course).

It's broken in pretty much every way possible, you can't sort the content by ratings or popularity, you can't browse by lecturer/publisher, there's no recommendation system, there's virtually nothing to distinguish between lectures on the same topic, some have awful sound recording but you have no way to know unless you listen to them, etc.

2) I think the more fundamental problem is that knowledge generally isn't available in small discrete chunks but rather in books, lectures, etc.

</comment></comment></comment><comment><USER4> Material with no dates, software version numbers, etc., so that it's hard to tell whether information is obsolete or not.

Topics that are difficult to search for (D, Processing, ...).

Lack of mid-level information. (Say I want to learn to build websites. I can easily find, "HTML tags begin with '<'". I can also easily find, "Here's the bestest, coolest CSS grid." Quality tutorials at a level between these two are much rarer. Similarly, "to output in Python, use 'print'" vs. "Here's how to optimize your Django-based site." But in between ... ?)

Video tutorials for anything that doesn't involve physical action. (Give me a video to teach me how to ride a unicycle, but not how Newtonian mechanics works. How to type, yes, but not how to code.)

Video without subtitles/transcript.

Audio-only for anything at all. Ick.

</comment><comment><USER5> A significant amount of what is written on the Internet seems to cater to the extremes of opinion. Therefore it can often be difficult to find something rational, well thought out and considered. This makes analysis of subjects very difficult because there is no moderate voice or that voice gets drowned out by the extremists.

A second issue is that a good many articles online that profess to be teaching something cite no sources whatsoever. As a lawyer I find it very difficult to move past that, and even if the content seems _good_ , I'll immediately be put off using that source to learn from.

<comment><AUTHOR> What if every resource on the web was put to the test against a community? Rather than just existing, a community would have to sort-of approve you in order to be relevant on a certain topic?

What if that resource was somehow validated/curated by people that have used it before? Or was submitted by an expert that topic? Would you be more willing to give that resource a try?

<comment><USER6> Yes!

We have that already, though (StackOverflow).

<comment><AUTHOR> What if you wanted to learn something that is not related to programming? What if you wanted to know the best books/blogs/etc to learn how to make awesome tutorial videos?

Where do you usually go in that case (for validated/curated resources)?

(And event on SO these kind of questions get closed down. Some get protected, but is only after they get significant traffic. [http://stackoverflow.com/questions/1711/what-is-the- single-m...](http://stackoverflow.com/questions/1711/what-is-the-single-most- influential-book-every-programmer-should-read))

<comment><USER6> Quora was awesome until their privacy fiascos.

</comment></comment></comment></comment></comment><comment><USER7> For me, the biggest problem is going past beginner and becoming intermediate at something. It always seems like the lists of curated resources are targeted towards either beginners or advanced, never in between.

</comment><comment><USER8> Not being able to ask questions one-on-one to someone who knows it, has been through it before, because in my experience, a lot of leaps in learning happen when someone explains something from a different point of view. And no, IRC is not good enough.

Finding resources used to be a problem, but it's mostly not any more. And I can't really learn anything well from just one resource. I like to drink from many wells.

<comment><AUTHOR> "Finding resources used to be a problem, but it's mostly not any more" Why is it not a problem any more?

How many wells usually?

<comment><USER8> At least for the things I'm interested in (programming, music, cooking, marketing), there are plenty of good reputable sites and apps with high quality content. Google, Youtube and Stack Overflow are a good starting point. Now there's also Udemy, Coursera, Udacity etc.

Could finding resources be better? Of course! Everything can be improved.

But if your question is what's the _most_ difficult part of my learning, then honestly it's not finding material. It's getting over the roadblocks in the journey.

I have thought of this problem a lot, and I can sense that you may have already formed an idea around making a better search or discovery tool. That's an easy one for programmers to fall for. But just because it seems doable, it doesn't mean it's the most important problem to solve.

For example, before Khan Academy came around, no techies really understood that one of the most important things in learning is simply good material. No amount of cool tools and search engines will help you unless you have good content to begin with.

<comment><AUTHOR> I don't really have a problem finding the material either for a topic I am somewhat familiar with. Might take some time, might take discerning over more than a few resources on the web. But I do find it. However my point is what you just said, good material is important. And the tools for finding the material search the whole internet which has a bunch of useless stuff. And thus cost me sometime I rather spent elsewhere.

Your sense is correct. But is not around the idea of a search engine. Is about a tool/place that only has good material. Relevant, validated, curated material. Would something like that help you?

Do you feel just as confortable finding the material for a completely new topic as you do for when you are looking for something you know and you are only trying the deepen your knowledge regarding that topic?

<comment><USER8> _Relevant, validated, curated material._

The sites I mentioned above are already doing that. Plus I also like to curate material on my own.

Only two things would really help me -

1\. You create more amazing content for things I'm interested in learning.

2\. You connect me to people who can answer my stupid questions when I get stuck - in real-time. Any delay just kills motivation.

</comment></comment></comment></comment></comment><comment><USER6> Questions on forums that are responded to by the OP with "Nevermind. Got it."

Thanks for helping the rest of us with the same problem, you jackasses! :P

</comment><comment><USER9> Time, lack of time really, because man o man i can get caught up and obsessed once I'm trying to learn something new

</comment><comment><USER10> Sounds like you're up to something similar to an idea that I've been batting around for a while. Best of luck!</comment>


ZumoDrive rolls a hard six - <AUTHOR> http://www.daemonology.net/blog/2010-03-11-zumodrive-rolls-a-hard-six.html <comment><USER2> If you're going to write an article overtly bashing your competitors, you should do better than picking on them for saying "military-grade cryptography".

The fact of the matter is that the only real differentiator between Zumodrive and Tarsnap is the integrity of the code that implements the service. Nobody is going to break TLS in order to get Zumodrive data.

Cryptography has exactly one implication for attackers: it is an opportunity to cause unexpected things to happen at the target. This is only possible when you do something unusual with cryptography. From that perspective, Tarsnap worries me more than Zumodrive: there is nothing that is going to go wrong with their SSL implementation that I'll be able to take advantage of, and I can't say that about your contraption.

(Here you will inevitably point to a string of OpenSSL security advisories to attempt to refute this point. You won't be convincing, for two reasons. First, it's been a long time since someone found an OpenSSL flaw that would move the dials for an attacker in a basic one-way-authenticated SSL session. Second, no security practitioner would trust your code _more_ than OpenSSL, which, while terrible, has had something like 15 years of audit exposure.)

From what I can see, nobody professional has stated that they've looked at Zumodrive _or_ Tarsnap. I'm pulling for you, Colin, but you haven't earned the right to impugn other people's security.

You should rewrite your article. Instead of trying to tear down a competitor, you should write an article about how Tarsnap is different from other backup solutions. You should write about how your threat model is different, and how you believe you're the only solution that has been architected to encrypt backup data in such a way that even the hosting providers can't access it.

You blew a bunch of credibility by trying to make these points while sniping at a competitor. Instead of thinking about how great Tarsnap is, I'm left questioning the objectivity of every line you wrote. What a waste! There's a reason every business book in the universe says not to disparage competitors. Go read one!

<comment><AUTHOR> _you should do better than picking on them for saying "military-grade cryptography"_

Have you read Schneier's "snake oil" post? It's all about "how you can pre- judge products from their advertising claims" -- Schneier's words, not mine. You see a classic snake-oil claim, and you immediately know that they're getting stuff wrong.

 _it's been a long time since someone found an OpenSSL flaw that would move the dials for an attacker in a basic one-way-authenticated SSL session_

The great thing about SSL for an attacker is that there are lots of ways to attack it. Do certificates with NUL characters move your dials? How about a certificate which is forged by exploiting an MD5 collision?

 _There's a reason every business book in the universe says not to disparage competitors._

I think you've already established from our past conversations that I'm a really crappy businessman. I didn't write this post in an attempt to steal ZumoDrive's customers -- most of them wouldn't be able to get Tarsnap installed.

I wrote this post as a security guy, because ZumoDrive's smug "even Cylons won't be able to access your data" attitude annoyed me. I hope you'll agree that I know something about security and cryptography and am entitled to speak from that perspective.

<comment><USER2> Have you read anything I've said about Schneier? Sorry, I don't hang on his words quite the same way you seem to be.

You're also taking Schneier out of context. Schneier was talking about genuinely batshit products like VMA and TriStrata, products that claimed to have redefined encryption or to use 4 meg keys. He wasn't talking about people claiming that _AES_ was military grade.

The terrible thing about OpenSSL for an attacker is that everyone has already attacked it. NUL characters broke it. CA's with MD5 broke it. Session resumption broke it. As an attacker, how I wish I had something other than OpenSSL to work with! I could break it with NUL characters! It'll rely on MD5 somewhere!

You wrote your post as a security guy. You have a conflict of interest. I think you stepped over the line. You clearly disagree. Let's agree to disagree.

<comment><AUTHOR> _He wasn't talking about people claiming that AES was military grade._

Well, no. But only because AES didn't exist yet. Saying "this is secure because it uses 256-bit AES" is just as bogus as saying "this car will be fast because it has a powerful engine" -- and the CNSS knows it, which is why NSA- approved cryptography consists of "an approved algorithm; an implementation that has been approved for the protection of classified information in a particular environment; and a supporting key management infrastructure"... not just the algorithm itself.

I'm having trouble understanding how someone who wrote "if you're typing the letters A-E-S into your code, you're doing it wrong" fails to grasp the bogosity inherent in "using AES makes this military grade". I thought you'd be cheering me on at this point.

</comment></comment></comment></comment><comment><AUTHOR> I feel bad about bashing a YC company -- even though I'm not part of YC, I feel that I've been on news.YC for long enough to be at least somewhat part of the YC community -- but seriously, this is your idea of security? I'm sure you can do better.

<comment><USER3> Don't. The only thing I'd suggest is the disclaimer "I'm just the author of a competing service -- Tarsnap. [...]" belongs at the top. It doesn't invalidate your points but if there's any reason to perceive a conflict of interest, the sensible thing is to get it out of the way first, rather than as an aside at the end.

<comment><USER4> Yup, honestly, the post is really good but the plug at the end gave a linkbait flavor to the whole thing.

<comment><USER5> My reaction was, "Oh, this is cperciva's blog, that man knows his stuff."

<comment><USER6> Agreed but few things are most distasteful than technological catfighting.

<comment><USER7> I don't see this as a cat fight. People using online backup services are being sold "security". Not all users care about, much less understand, security to the extent that user of tarsnap do, but users should know if a product's marketing matches the reality of the product. It is common in most industries for a competitor to point out these gaps.

Colin provided a tasteful opposing argument to ZumoDrive's marketing, IMO.

</comment></comment></comment></comment></comment></comment><comment><USER8> What's wrong with using client-authenticated SSL with predistributed keys (and only trusting the pre-distributed keys)?

I trust a well-tested TLS implementation more than I trust whatever crypto I can manage to write myself.

Also, to provide the features ZumoDrive does, they have to have access to your unencrypted data - don't they? They aren't even attempting to keep your data safe from their server (and never claim to). It's not the trade-off I would chose for my company's production data (my company - Postabon - uses Tarsnap for that ;-)) - but it's perfectly valid for my low-sensitivity personal files (I use Dropbox for most of my personal stuff).

(Incidentally, as someone with active TS clearance who has written 'military grade' code currently deployed on JWICS, 'military grade' doesn't mean that much in terms of crypto - at least for the 'application level' stuff I worked on ...).

<comment><AUTHOR> _What's wrong with using client-authenticated SSL with predistributed keys (and only trusting the pre-distributed keys)?_

If you set up your own CA and you distribute a CA keyring with only that CA key, you avoid the what-about-China problem. But you still have a heck of a lot of moving parts which can break. (EDIT: Also, I'm 99% certain that ZumoDrive isn't doing this.)

 _I trust a well-tested TLS implementation more than I trust whatever crypto I can manage to write myself._

You should come to my conference talk, "everything you need to know about crypto in 1 hour". :-)

 _Also, to provide the features ZumoDrive does, they have to have access to your unencrypted data - don't they?_

To be honest, I haven't looked at exactly what features ZumoDrive has. I just saw them making bogus claims about their security, and decided to call them on it.

<comment><USER2> Recommending that developers implement their own cryptography after watching you talk for an hour is pretty close to professional malpractice. Most professionals --- including many who have done a lot more crypto that you --- would recommend _the exact opposite_.

Here's an easier argument that lands in the same place: if you roll your own crypto, and it breaks, you will look incompetant. Everybody will ask, "why didn't you just use TLS?", and your answer will be "so I could write this custom protocol that just destroyed my security!" On the other hand, if you use TLS, and someone asks why, you will simply say "because if TLS fails, people are going to target the banks and stock exchanges before they target my service."

For the record: you have Colin Percival on HN suggesting that hand-rolled crypto beats SSL. Colin's a smart guy who really knows crypto.

You also have Thomas Ptacek on HN suggesting that Colin is absolutely full of it. Thomas isn't as smart as Colin, but, on the other hand, Thomas has been breaking software professionally since 1995, and has more crypto findings than Colin.

Make up your own mind.

<comment><AUTHOR> _Recommending that developers implement their own cryptography after watching you talk for an hour is pretty close to professional malpractice._

You should hear my talk before you accuse it of constituting professional malpractice.

<comment><USER2> I concede this point until May.

</comment></comment></comment></comment></comment><comment><USER9> The problem I have with ZumoDrive's security claims is not that they're insecure -- they sort of have to be, given the feature set they have -- it's just that their claims are theatrical.

They could make things so that data can only be accessed right when the user enters their password, without having to give up the cross-user deduplication that I presume they'd perform, but ultimately, if you want a convenient online storage service, with data meant to be shared across computers, and browsable online or in other convenient circumstances, going with full-blown Tarsnap- like security is going to be a pain.

<comment><USER10> I admit that deduplication isn't going to work if you encrypt everything with different keys, but why can a Tarsnap-like design not be "convenient" in the way you seem to use the word?

A few good (encrypted!) indices are all you need. You could write something like a WebDAV proxy if you want to make it "universally" accessible.

(Of course, Tarsnap isn't designed for this, but that doesn't mean that it couldn't be.)

<comment><USER11> You upload the file with computer A, and you want to download it with computer B. Computer B has to be able to decrypt the file that was encrypted on computer A. If you want this to be doable without keys being installed computer B ahead of time (for example, you want to be able to go over to your friend's house and download the file from his computer, using just the web browser), then the server has to know the encryption key.

For my own personal use, I prefer something more like Tarsnap's or Mozy's design, but the benefits of ZumoDrive's design definitely would be appealing for many users.

<comment><USER12> No, computer B just needs some way to access the encrypted key for the files from computer A. You can either have computer A create a master key that gets encrypted with a user-supplied password and then handed out to any client that passes a "does user A approve of this transfer" check, or you can use fine- grained ACLs or capabilities similar to what is done in something like Tahoe- LAFS. The server does not need to see unencrypted data in either case.

<comment><USER9> The hard part here is for computer A to be sure it's handing the information it thinks it's handing it to. No matter how you do it, computer A needs to be sure it's giving permission to computer B, and not somebody claiming to be computer B, and that involves either personally meeting beforehand to trade some kind of keys or trusting a third party.

<comment><USER12> Thus the additional re-encryption of the master key. If this re-encryption key is secure then you don't need to care who the master key is handed out to as only an authorized party can decrypt it. There are other, more complicated, crypto schemes that can make this process easier or more secure, but something like this has KISS appeal.

An external channel is required here (to transmit the re-encryption key) but that can be as simple as a phone call or email; anything that does not need to pass through the third-party holding the data files.

</comment></comment></comment></comment></comment></comment><comment><USER13> Every time I see one of your websites I think of a homeless guy holding a sign that says: "will trade strong crypto for good web design". :-p

<comment><USER14> I am reminded of these old lines by Neal Stephenson:

 _The Hole Hawg is a drill made by the Milwaukee Tool Company. If you look in a typical hardware store you may find smaller Milwaukee drills but not the Hole Hawg, which is too powerful and too expensive for homeowners. The Hole Hawg does not have the pistol-like design of a cheap homeowner's drill. It is a cube of solid metal with a handle sticking out of one face and a chuck mounted in another. The cube contains a disconcertingly potent electric motor.[...]_

I have no objections to beautiful design externals, but would prefer it dresses up good engineering instead of hiding shoddy innards.

Actually, the other day a nice Mac online backup app showed up here, and my private thought was that the author and Colin could probably profit from a collaboration.

</comment></comment><comment><USER15> How can you possibly compare a consumer service ment to make it easy to access files across multiple devices with a backup solution ment only for the most technical people? Can you imaging if ZumoDrive had you (or your parents?!) generate your own crypto keys which you would then have to manually transfer to your iphone when you wanted to access your data on it? Think a web interface sounds nice? Great, just login with your username, password, and crypto keys (that hopefully you have memorized), so we can decrypt your files and render a web interface.

The article makes some decent point and if you're storing the nuclear launch codes, yeah, don't put them in ZumoDrive. Otherwise, the article would have been much more useful if it suggested alternatives that would still operate within ZumoDrive's existing user experience.

<comment><AUTHOR> I wasn't comparing ZumoDrive to Tarsnap (except in the very last paragraph). I was comparing ZumoDrive to their own propaganda.

</comment></comment><comment><USER16> > So as you can see, the Cylons have many hurdles to overcome in order to take > over ZumoDrive and your data.

Isnt that essentially wrong? The cycolns have to overcome exactly ONE hurdle to steal the data. (Not a security guy by any strech of definition.)

<comment><AUTHOR> It depends in part on how you count things; but yes, ZumoDrive is more weakness-in-width than defence-in-depth.</comment></comment>