What We've Learned About Teaching Code - <AUTHOR> http://www.codecademy.com/blog/9-invisible-stumbling-blocks

<comment><USER2> Since I know the codecademy team is always listening, I'll share my feedback through supporting my two friends through codecademy:

Firstly they love it. The game mechanics and the reward cycle is a great motivation for them. I think nobody can argue that you've found a great way to get TONS of people to enjoy "learning to program".

The second part is a bit tricky... are they really learning to program?

IMO the problem with all pragmatic approach is the lack of _the need to understand_. I know you didn't intend it, but codecademy suffers from the same tired "tutorial" approach. Users follow instructions to win the prize.

I will say codecademy is better than the tutorial approach, but it's still a tutorial.

The fundamental problem is my two friends _need_ me to teach them how to think in code, how to conceptualize the problem, how to understand that "i am taking this problem, i am working out a solution in my brain, in english, and then i will write this solution in code" They simply do not have the capacity to do that. And they are 5 months in through codecademy.

Just yesterday my friend had the idea that when using a for loop, the loop passed all values at the same time to the nested switch statement, upon which the switch statement would evaluate ALL the variables at the same time, using whatever the hell case was the best match.

He couldn't pass the level because he did not visualize in his head that the for loop passes each value, one at time. Then it procedurely flows down, _line-by-line_ into the switch statement... and so on.

My friends do not have pictures in their head about how code works, why it works that way, and how to use those pictures to draw their own.

They don't know how to code.

EDIT: sorry one more thing. The only lifeline they have when they get stuck (aside from asking me) is to look at the QA. I have _never once_ seen an answer that explained the answer, nope, it was "here put this magic code in it and that way it will PASS! YAY!" And I mean answer in the sense of "why", not why does javascript require a return here instead of there, or why the "right" answer is to put this code before that code, or the strange reason you need this bracket here instead of there -- I mean why! why? really...why?

<comment><USER3> That's not the worst thing in the world, since most pedagogy that works is of the basic format "You should know X. What should you know? _Class repeats X._ Good, because you should know X. Timmy, if I say Y, what do you say? _Timmy repeats X._ Good job Timmy, because you should know X. Susan, if I say Y, what do you say? _Susan repeats X._ Good job Susan, because you should know X. You should also know that if Y', X'. What should you know? _Class repeats if Y' then X'._ Billy, if Y', what do you know? _Billy says X._ Can anyone point out Billy's mistake? _June does._ Good job June, because if Y', X'. Billy, try it again. _Billy does._ Good job, Billy. What if Y instead? _Billy says X._ Good job Billy. Billy got the right answer because Billy knows X, except when Y', then X'. Class, what have we learned? _Class repeats X and if Y', X'._ "

While it is true that they don't know how to code, the more specific status is that they are presently learning to code. That's not the worst thing in the world -- so am I, and I get paid for it fairly regularly.

<comment><USER2> Essentially you are saying _something is better than nothing_.

I wholeheartedly agree.

As a person whose purpose in life is more and more "Free information in order to Free Education", all I'm saying is I think we can do better; a lot better.

Rote memorization certainly works. But I don't think anyone anywhere, has ever proved that it's an efficient or even particular _good_ way to learn something. And yet modern civilization takes this for granted.

p.s. I never went to college so this is all outside-in.

<comment><USER4> At the risk of being pedantic, it's worth noting that some things benefit from memorisation (e.g. the alphabet) and some things benefit from "higher" learning (e.g. understanding the concepts of programming). I don't think patio11 is necessarily saying "something is better than nothing"; sometimes it is _better_ to teach someone 'if you see the shape O, you say "oh"'.

<comment><USER2> touché =)

I understand that very clearly when you put it that way. I remember my dad beating the alphabet into my head. It was the only way that he could eventually teach me how to read.

Thanks for that.

</comment></comment></comment></comment></comment><comment><USER5> When you're teaching something completely new to someone, at first you won't even have a common vocabulary. This is true no matter what you're teaching, and you have to dedicate some time to establishing the language (English, not computer).

One thing that makes coding a little harder is that many of the analogies we make for non-coders aren't especially clean: A hash is like an set of cubby holes, each can be named and filled, and the set can be infinitely expanded. Packet routing is like trying to find your way from New York to California, only stopping at major cities to ask for a general direction. Memory is like a big sheet of paper, and x = 5 is like writing 5 somewhere on the paper, and x somewhere else, and then drawing an arrow between them.

I'm not saying these are the best analogies (or even any good), but I have yet to hear ones that aren't riddled with holes. The average non-coder doesn't have the context to back-fill these holes. As an instructor, you need to realize this and take the time to lay more of a foundation than you think.

<comment><USER6> Excellent point. Not only that, but analogies always come along with extra bits that may lead them down the wrong path. It's very tricky to find just the right metaphor.

<comment><USER7> Richard Feynman answering the question "How do magnets work" in an informal pick-your-brain type interview:

"I can't explain that attraction in terms of anything else that's familiar to you. For example, if we said the magnets attract like rubber bands, I would be cheating you. Because they're not connected by rubber bands. I'd soon be in trouble. And secondly, if you were curious enough, you'd ask me why rubber bands tend to pull back together again, and I would end up explaining that in terms of electrical forces, which are the very things that I'm trying to use the rubber bands to explain. So I have cheated very badly, you see. So I am not going to be able to give you an answer to why magnets attract each other except to tell you that they do."

<comment><USER4> From the 1983 BBC "Fun to Imagine" series. Video for reference: <http://www.youtube.com/watch?v=wMFPe-DwULM>

<comment><USER2> this is one of the funniest videos I've ever seen. I love HN!

</comment></comment></comment></comment></comment><comment><USER8> I've had a couple dozen students working through many of the CodeCademy programs this semester as an experiment. And most of the Javascript lessons currently on the site are just barely above mediocre.

<comment><AUTHOR> Hi teach - would love to hear your feedback after working through it for a semester. Feel free to shoot us an email!

<comment><USER8> The core problem is what you've identified in your blog. You assignments don't explain many core concepts that students struggle with, they move WAY too quickly through concepts, and there's no coherent sequence. For example, in the middle of the "Conditionals in JavaScript" assignment/tutorial, you throw in arrays and loops. Both are MUCH harder than conditionals.

Zed Shaw, on the other hand, does a marvelous job of not covering concepts until the prerequisite knowledge is already in place.

<comment><USER5> Mostly I agree, except for his introduction of %r very early on in python the hard way. What %r does in the context of the lesson is clear, but many students ask why and what it's for, and the complete answer is much more difficult.

Frequently, I just settle for "it adds quotes around strings" because the truth is a bit much to handle at that point.

</comment></comment></comment></comment><comment><USER9> In college, I listened to some advice about choosing less experienced instructors because they have more recently been through the same material that they are teaching. Plus, they'd be more motivated and less jaded. Turns out that the experience factor is not that important.

At this point, after having many mediocre teachers and very few good ones, I've come to the conclusion that only a small percentage of "teachers" are actually worth learning from.

The only good teachers I've had were meticulous about their knowledge AND really loved teaching. Not one or the other.

It basically requires a full-time teacher. Anyone besides that is actually worse for me than no teacher because they are apt to ruin my interest in the subject. Maybe I'm spoiled, but most classes aren't much better than a textbook and a chat with a good friend.

Who does that leave as worthwhile teachers? Rare people like Feynman, a couple of instructors on Lynda.com, one or two from my undergraduate classes, and a couple from the new array of online classes. Again, you can be a grad student and be a great teacher, but you have to know your domain inside and out, and love teaching it. That means fielding questions with ease and, probably, being able to teach without notes if needed.

One of the reasons I like open online courses is that you get to experiment until you find an experienced professor who had enough initiative to start an online course in the first place. I really do mourn the downfall of the in- person class setting, but at least in my experience, a vast majority of them aren't what they're cracked up to be. Maybe at top 10 schools the situation changes?

</comment><comment><USER10> I am a student at codeacademy, I am 41 years old and I have had always the urge to learn programming, I have tried many online tutorials in different programming languages and @ first it is exciting but later on it gets fustrating and finally I get lost, codecademy has given me hope again that i dont have a disability in programming, yes I get stuck and I have to do the exercises 3 or 4 times until I grasp.the concept, but I can feel my progress and I am allways excited to take the lessons every day

</comment><comment><USER11> I really enjoy codecademy (I am currently at 930 points and 47 badges). I find its a great way to learn and practice new concepts with a much smaller barrier to entry and instant feedback. It is by no means perfect. There are a few issues that come to mind: 1\. Because of the way the code validations are written there tends to be only one or two ways to pass a lesson. This can lead to frustration when a student writes a piece of code that performs the task correctly but because it doesn't validate correctly he/she doesn't pass. 2\. I found (for me) that the pace is actually to slow. I have cruised through all the lessons and have participated in beta testing some of the more advanced javascript modules (i.e. introduction to JSON). It would be nice if there was more advanced content to move on to but this should be corrected as time goes by and more content is created. 3\. General spell check and editing could be better 4\. Currently there is no content that talks about the full stack of technologies in a web application. This leaves the student studying small siloed pieces such javascript/html/css on their own without a view of the bigger picture. How does a web server fit in? How do I communicate with a database? Why is there no talk of MVC or REST? Basic coding skills are great but without a comprehensive picture of an application they are pretty useless.

Even with these issues codecademy has been a fantastic resource for me. I have learned a ton and have gone on to start teaching myself more advanced topics and have been learning different libraries such as backbone.js, node.js and d3.js. Without codecademy I would not have been able to get through the documentation on these libraries. One of the most valuable things that codecademy has taught me is to not be intimidated by technology. From the outside the programming world can seem like a pretty intimidating place. Codecademy makes that first step a little easier...

</comment><comment><USER12> "There are known knowns; there are things we know we know. We also know there are known unknowns; that is to say we know there are some things we do not know. But there are also unknown unknowns – there are things we do not know we don't know. " The Johari Window - quote from Donald Rumsfeld

This is the point of user acceptance tests - it doesn't matter if the code does 100% what it was designed to do. If the users can't make it work, it's no good.

Nice analysis from Codecademy.

<comment><USER13> I love that quote. In a way, this article is talking about the "unknown knowns" -- the things that are so obvious now that you don't even remember learning them, or can't imagine not knowing them. These are the lurking biases and preconceptions that we aren't even aware of having, and may be just as dangerous as the "unknown unknowns".

</comment></comment><comment><USER14> I'm going strong on codecademy. It's great to have a structured approach to learning. There are so many resources out there that it's difficult to even begin to learn coding. I don't expect that this will ultimately teach me to build products with code but it at least will introduce me to common/core languages and provide a base to continue my studies through other means.

Right now I'm working through the classes nightly. 15 badges down...no clue how many to go.

</comment><comment><USER15> Interesing to read this and all the replies. And it got me thinking. Part of what has been a great learning experience for me is the "detective work" that I had to do to understand why. That involved a lot of googling, but it paid of and made me more hungry for knowledge. And when I try to code things on my own it has helped me to survive the debugging. So perhaps part of the problem also is the student. When did we start expecting that one webpage would gives all the answers?

</comment><comment><USER16> "There is an interesting paradox in teaching: the better you know a subject, the harder it is to talk to beginners. Experience means you have forgotten what tripped you up when you were a beginner."

This reminded me of how I always have to clearly explain to my beginner piano students that the higher the note on the staff, the further right on the piano it goes. It's very non-intuitive that up/down on the staff = right/left on the piano.

</comment><comment><USER17> I agree 100%. Codecademy is great way to learn the syntax and some of the best practices. I agree their is a gap in understanding _what_ your doing.

I went through Stanford's Programming Methodologies on iTunes U (free!), and they go over a lot more of the why, as well as decomposition and other stuff.

What if Codecademy had short video/audio lectures after each section that would show more of a recap of how/why it works?

</comment><comment><USER18> This phenomenon - of the difficulty of being able to teach something once it is obvious to you - has the rather unfortunate name - "the curse of knowledge", and it is well documented based on research in other fields too. There is a good discussion about it here : <http://37signals.com/svn/posts/213-the-curse-of-knowledge>

<comment><USER19> When I was teaching I found that you have to learn the subject, then you have to learn to teach the subject. In a pinch some teachers do both at the same time, and as long as they are bright and it is not an advanced level class, this can actually work _better_.

</comment></comment><comment><USER20> Isn't this common sense? If you've ever tried to teach anyone anything, you've run into this.

<comment><USER21> It's obvious, and they should have known.

In my experience the best people to educate the newbies are the people who were newbies a year ago. They know what the roadblocks were for them, and the don't know 'too much' as to complicate things.

<comment><USER22> It's funny because education is actually is backwards here. You're supposed to want to be taught by an expert in the field.

<comment><USER19> A local maximum will come from those who recently acquired the knowledge. But truly _great_ teachers, that can consistently reach students of diverse aptitudes and thinking styles, are made over the course of decades.</comment></comment></comment></comment>


One Chart, Twelve Charting Libraries - <AUTHOR> http://lisacharlotterost.github.io/2016/05/17/one-chart-code/ <comment><USER3> I can only speak for R but I guess it's the same for all of them: With just very few options the output can be vastly different.

Have a look at some basic ggplot2 examples (all examples were made from the same data): [http://tutorials.iq.harvard.edu/R/Rgraphics/Rgraphics.html](http://tutorials.iq.harvard.edu/R/Rgraphics/Rgraphics.html)

I hate to be negative, but this overview is useful only for people who don't really need it - who want to have a look but not actually do anything with it. It's not useful to select a library (especially since it compares completely different languages), and if you already know which system and language to go with it's not useful either.

If you think about learning R: If you don't also learn (a significant amount of) statistics it's a waste of time IMHO. There are (free, if you ignore the "verified certificate" options) courses available on Coursera and edX - <USER2> Microsoft has one (on edX). It's worth it - and I mean learning the statistics, not just R. Even if you don't think you need it professionally. Don't try using R as a "graphics" (plotting) or even a programming package - quite frankly, it's not very good at the latter (all modern "real" programming languages are better and more consistent and less "hacky"), but to work your way through lots of DATA quickly R is beautiful.

<comment><USER4> I think the post is useful as an overview of a lot of options, and how hard they are to get started with.

True, you'd use R charts because your data and analysis are in R, you wouldn't use R because of the charts.

<comment><USER5> Hm, I don't think you can speak for everybody. I find myself (re)creating a chart in R quite often. I sometimes create visualisations for print, and I just want an SVG or PDF to then import to Illustrator. Before I knew that you can export PDFs in Tableau, I often used Tableau for the analysis part and then went to R to recreate the same chart and export as PDF.

<comment><USER4> hey, if it works! though doing analysis in Tableau and charts in R does make me cringe a little … [https://goo.gl/9mgTTI](https://goo.gl/9mgTTI)

</comment></comment></comment></comment><comment><USER4> Great post... The two I would have been interested in seeing, if they support that type of chart, are Google Charts and plotly.js. (maybe I'll look into it if no one else does)

Pretty curious to see what else people come up with in comments...

<comment><USER5> Hi, author here. Plotly was the biggest surprise for me when I was writing the two blog posts, and I definitely want to try out plotly.js as well. Could take a few weeks, though :) Go ahead and recreate that chart yourself! I already had John Muyskens from the Washington Post Graphics team add the brand news Python Leather library to the repo: [https://github.com/OpenNewsLabs/onechart- twelvechartinglibra...](https://github.com/OpenNewsLabs/onechart- twelvechartinglibraries)

</comment></comment><comment><USER6> A performance comparison would be good. I was trying to plot an audio file (say 1 million points - something that Matlab could easily handle) and totally failed to find a graphing library that didn't fail miserably on it.

<comment><USER7> Couldn't you just downsample the wave file?

<comment><USER8> I don't know why you are getting down voted. This is the correct answer; when a screen only has 1000 pixels of graph you can't plot more than 2000 points of time domain data, max and min of each column. As you zoom in resample for the correct range. Influxdb can help do this, very quickly. I can allow up to 200000 points of raw data before I need to do any pre-computation and still maintain a 100 ms charting latency target.

</comment></comment></comment><comment><USER9> Thanks, I found this interesting.

> And I couldn't combine a log-scale with setting the domain of the x-scale to > zero

I don't think it's mathematically possible to have a log scale start at zero, you just make the exponent more and more negative. The first two charts look like you've done it but they're not correct--you don't want the _values_ to be log, you want the _scale_ to be log. In ggplot2 you do this by adding "scale_x_log10()" to the plotting expression, and in native R you usually pass log="x" (I believe).

<comment><USER5> Great point! I'm surprised that nobody else noticed that so far :) sometimes I set the values to log because I couldn't find an option to set the scale to log, but you're right, in R and ggplot2 I should use your described options.

<comment><USER10> And on a log scale you probably want to set the minimum value to 1 since the log of zero is negative infinity (I suspect that's the root cause of your ggvis problem)

</comment></comment></comment><comment><USER11> Most of these new charting libraries seem to be specialized to "data science" or statistics or whatever. R's plotting thing and ggplot are quite nice for stats... most of the javascript plotting libraries are okay. I still haven't found anything that makes plots as nice as Igor Pro or Origin Pro with as fast an update rate, AND features zooming and movable cursors. Yeah yeah you can hack them in with matplotlib but who really wants to do that?

</comment><comment><USER12> Was looking forward to reading the article but I'm on an ipad and the left- hand menu seems to overlap the main body content?

<comment><USER5> Sorry for that; fixed it!

<comment><USER12> Thanks so much. Just spent an hour reading articles on your blog. Very informative

<comment><USER5> Oh I'm glad to hear that! Let me know if you have any ideas for future blog posts :)

</comment></comment></comment></comment><comment><USER13> Not a charting library, but much faster and doesn't require any code - here's my alternate take using Tableau:

[https://public.tableau.com/views/WorldHealth_4/WorldCountryH...](https://public.tableau.com/views/WorldHealth_4/WorldCountryHealthIncomeandPopulation)

<comment><USER5> Hi there, thanks so much! I also tried 12 applications for data vis here; including Tableau: [http://lisacharlotterost.github.io/2016/05/17/one-chart- tool...](http://lisacharlotterost.github.io/2016/05/17/one-chart-tools/)

<comment><USER14> Would you have a look at Vize Software ? (Disclaimer: I'm a cofounder) :)

<comment><USER5> Looks great for big datasets; respect! A small thing: Why did you decide to bring the "Modifier" panel to the right-hand side of the screen? Lyra is doing the same thing. It results in SUCH a long way to drag your variables. Besides that: Neat tool! Hope you'll be successful with it.

<comment><USER14> Thank you :) Funny you mention that, we're in the process of wrapping up a UI overhaul, and the modifiers panel is right next to the variables one. Meanwhile in the current version you can also double-click to have your variables added automatically to whichever chart you're on (based on a charts suggestion engine).

</comment></comment></comment></comment></comment><comment><USER15> d3 is way overkill for static chart (i skimmed your code and there's no callback for events)

Interactives are what missing from others. Sure you can see the largest circle, wonder what that is, look up csv, ... second largest circle? rinse repeat. wasting time? sure

with d3, you can hover a circle and get its horiz and vert rule to indicate its center's position on x and y axis -- also a small popup box for simple info, like name, id, etc.

you can summon external vis by clicking on said circle and say, a table appears under the chart, showing rows of data relevant to said circle, or ... other charts for the matter.

the code is not terribly long. i did it 3 years ago.

i don't know how to do interactive chart like i did in d3 in matplotlib, granted i haven't touched matplotlib for 13 years (i think i used numarray back then and feed the result to matplotlib because i refused to use matlab)

</comment><comment><USER16> Great article! I wouldn't mind if you were even more opinionated. If I was looking for a charting library I'd very much like to know what you consider really good and what stinks. Especially with this much research.

</comment><comment><USER17> Are there good comparisons to Mathematica?

</comment><comment><USER18> Why did he dislike Bokeh because it used Canvas over SVG? From what I've seen, the performance of each really depends on what you are doing with it.

</comment><comment><USER19> These comments are pretty nit-picky. Great article, thanks !

</comment><comment><USER20> This really doesn't do much for me. Any chart that fits into an examples page is pretty sure to look pretty good and be pretty easy to make with charting library X.

You don't really find out X was a bad choice until you run into obscure problems Z1, Z2, Z3.

</comment><comment><USER21> Deep eye roll on this.

Experts are chiming to show that with a few tweaks the output could be better for their respective lib, as they should. I really don't like comparisons like this. Not helpful.

<comment><USER21> God can I delete this comment to make the down votes stop?

<comment><USER22> When you find yourself in a hole...</comment></comment></comment>


James Clapper avoids charges for 'clearly erroneous' surveillance testimony - <AUTHOR> http://www.washingtonexaminer.com/james-clapper-avoids-charges-for-clearly-erroneous-surveillance-testimony/article/2651233 <comment><USER2> If we have learned anything from Trump it is that when lying you should never admit to the lie.</comment>


Firefox Inside Firefox Inside Firefox Inside Firefox - <AUTHOR>

Enter chrome://browser/content/browser.xul in a Firefox address bar. And you'll have Firefox inside Firefox!
A bit old, but nice for those who have not seen it. <comment><USER2> If this were Reddit, I'd be making a "yo dawg" joke right about now. But it isn't, so just pretend I said something anodyne about XUL or something.

</comment><comment><USER3> Cool....

</comment><comment><USER4> cross-instance testing!</comment>


Public Key Pinning Being Removed from Chrome - <AUTHOR> https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/he9tr7p3rZ8/eNMwKPmUBAAJ?hn <comment><USER2> I can't support this at all, and ironically this is partially my fault.

My and @eganist's Black Hat / DEF CON talk "Abusing Bleeding Edge Web Standards for AppSec Glory" demoed an exploit concept that we called "RansomPKP", which was essentially a pattern of hostile pinning that could theoretically enable pivoting from a web server compromise to holding a site for ransom. Hostile pinning was by no means a new concept, and even has some discussion in the IETF spec itself, but we found this to be a fun novel application and used it to spur some minor security improvements to browsers' HPKP implementations.

However, this talk also led to concerns being vocalized about the viability of HPKP in general ([https://news.ycombinator.com/item?id=12434585](https://news.ycombinator.com/item?id=12434585)), ultimately leading to this. This was not our intention at all, and I don't see hostile pinning alone as a reason to give up on HPKP.

I would much rather see some discussion around improving the usability of HPKP before jumping straight to putting it on the chopping block — both from a site operator's end and a user end. For example, off the top of my head, why not make it possible for users to click past the HPKP error screen like they can with any other TLS error screen?

<comment><AUTHOR> I think this has very little to do with you.

Hpkp was championed by a lot of security people, who in turn got a lot of people to foot gun themselves (Scott Helme even admitted that he is oftentimes one of the first people called by people who HPKP foot-gun themselves).

There were only a handful of sites that actually needed HPKP level security, and ransom-hpkp was the least of people's worries. Hpkp was more dangerous to people rolling it out on purpose than it was to mass header injection or similar :/

HPKP has been doomed from the beginning. Here is sleevi saying he regrets it in 2/2016: [https://twitter.com/sleevi_/status/696171562383224832](https://twitter.com/sleevi_/status/696171562383224832)

<comment><USER2> I agree that RansomPKP itself isn't that big a real-world concern (which was part of my point), but it did motivate the first wide discussions that I'd seen questioning whether HPKP should exist.

The linked Qualys blog post / HN thread was shortly after our talk, which (along with our conversation with Scott Helme around that time) led to Scott's post "Using security features to do bad things"[1]. RansomPKP and related follow-ups are directly highlighted by Scott's recent post "I'm giving up on HPKP"[2] in which he announced his decision to remove HPKP from the Security Headers tool[3], and Scott himself is cited in this post by Chris Palmer.

Note that I'm not suggesting that Scott himself is responsible for this, or that anything he's said has been in bad faith. My point is simply that my talk was one part of the chain of events that started the ball rolling on this conversation.

I'm also not saying that RansomPKP / hostile pinning is the most important reason that people have for not liking HPKP — in this case Chris lists it as only one of three motivations. Clearly, the usability issues with its implementation have been a much bigger problem, which is what I would like to see serious attempts to improve on before throwing out all the work that's been done up until now.

\---

Edit: re: sleevi edit: the tweet you linked doesn't say anything about regretting the concept of TLS key pinning entirely, just that it's done as a header. I'll admit it's ambiguous, but that sounds to me like he would rather have kept the feature but changed the API. I would be all for deprecating the HPKP header if it were replaced with a better / more usable interface to the feature.

\---

1: [https://scotthelme.co.uk/using-security-features-to-do- bad-t...](https://scotthelme.co.uk/using-security-features-to-do-bad-things)

2: [https://scotthelme.co.uk/im-giving-up-on- hpkp](https://scotthelme.co.uk/im-giving-up-on-hpkp)

3: [https://securityheaders.io](https://securityheaders.io)

<comment><AUTHOR> I will be VERY upfront that I DO blame Scott Helme for this. I mentioned this in 2/2016 as well[0]

It's fair. There was a lot of buzz about Ransom HPKP. The whole thing was doomed from the start, and I was pretty upset every time I saw anyone publicly push for it.

0: [https://twitter.com/ejcx_/status/698227927390023681](https://twitter.com/ejcx_/status/698227927390023681)

<comment><USER3> I worked with Scott on the HPKP components of that initial blog post (I'm sure he can confirm) and I won't blame him at all for what took place in hindsight. Google actually denied a bounty on disclosures surrounding RansomPKP, so there was nothing to suggest this was the path they would eventually follow.

<comment><AUTHOR> Again, I think this decision has nothing to do with Ransom HPKP and everything to do with how it's not a usable standard, and people who try to use it correctly fail.

</comment></comment></comment></comment></comment></comment><comment><USER4> Removing dynamic pins was inevitable given the associated risk for _all_ sites. Some ideas to fix those exist[1], but I'm not sure it's worth the effort in a fully CT-enforced web. That's probably time better spent somewhere else (such as improving CT itself and the gossip mechanism.)

I'm not convinced that static pins need to go too. There are something like 10 sites on that list currently, and all of them are valuable targets and should have the resources to ensure their pins don't fail. Even increasing that number to something like 100 should be manageable for browser vendors and would cover a large percentage of all page views (rather than just guarantee discovery after the fact).

[1]: [https://blog.qualys.com/ssllabs/2017/09/05/fixing-hpkp- with-...](https://blog.qualys.com/ssllabs/2017/09/05/fixing-hpkp-with-pin- revocation)

</comment><comment><USER5> This is especially funny to me as our PCI DSS Network Scan just started flagging not having a HPKP Header as something thats necessary to remediate. I've had to waste half a day on the phone and then to write a Risk Mitigation Plan that explains how we mitigate the risk of an MITM Attack in case our CA gets breached...

<comment><USER6> It is deeply fucked up if a scanning checklist demands PKP, since most sites --- including most commerce sites --- shouldn't pin.

<comment><USER7> Well, try explaining that to the HSTS and HPKP folks. They already have answers littered on stack overflow and HN to advise to enable it for anything and everything. With exactly zero consideration for the potential to backfire.

It's only a matter of time before an intern or an audit guy have it deployed on majorcompany.com and result in a disaster. Symptom includes none of the client ever able to access the site again.

<comment><USER8> does HSTS have potential to backfire?

<comment><USER6> Unless you're a static content site that is using TLS just to be an Internet Good Citizen to prevent passive traffic analysis, you absolutely should have HSTS enabled; it's not really a judgement call. Without HSTS, you almost might as well not do TLS at all; HSTS prevents a serious, effective, and easy attack.

By way of comparison, it has never been a good idea to default to HPKP. Privacy-sensitive sites should be pinned, and if you can't safely manage pinning, that's a pretty good sign that you're not mature enough to engineer privacy for the site either, so I don't have that much sympathy for the argument that it's a foot cannon (this is, of course, very easy for me to say). But if you're just selling coffee beans or scheduling laundry pickups, PKP has always been a very bad idea for you.

<comment><USER9> Why does being a static content site mean you should not enable HSTS? If anything, HSTS is easiest to roll out for static content sites.

<comment><USER10> One primary example would be sites like software repository mirrors, where the majority of content is signed already, and serving them over HTTPS provides negligible benefit to your users (other than the slight confidentiality increase in that an adversary wouldn't know what exactly you downloaded), as opposed to a site serving active content like JavaScript and CSS, which can have disastrous results to the users if an adversary tampers with them.

The latter example is where HSTS becomes an invaluable tool, since now the only way those resources could be delivered is through a trusted channel, verified by the PKI. The same value is not there for a software mirror, because of the other security safeguards already implemented, removing the need to trust the delivery channel. That said, most still do server their content over HTTPS as well.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Interesting HN-discussion about the future of HPKP from a little over a year ago [1]. Reading it, I think this move was predictable.

The article suggests the _Expect-CT_ header as a safer alternative. Scott Helme has a short but informative write-up how this works[2].

[1] [https://news.ycombinator.com/item?id=12434585](https://news.ycombinator.com/item?id=12434585)

[2] [https://scotthelme.co.uk/a-new-security-header-expect- ct/](https://scotthelme.co.uk/a-new-security-header-expect-ct/)

<comment><USER12> Crikeys. By that point the damage is done. How about a read-CAA-via-DNSSEC- and-confirm-that-it's-the-right-CA header?

(The certificate could embed a DNSSEC assertion about the CAA header or lack thereof, for that matter.)

</comment></comment><comment><USER13> Good riddance. It had low adoption and pales in comparison to what will be achieved with Certificate Transparency.

DNS redirect attacks (common/easy due to social engr) combined with malicious HPKP could result in some nasty ransoming ("many of your users can't access your site unless you pay me for the key"). I've heard many surprised it hasn't happened yet. Particularly considering the lack of recourse options for victims.

<comment><USER14> What would be the fix? I'm asking sincerely as someone who is only surface level familiar with HPKP, and have never implemented it (but my boss did...)

If someone ransomed you, would you need to pay them for the key, and then use the key on your site from then on? So, you could pay the ransom and they'd be able to decrypt all of your traffic from then on?

(I'm sure I just don't know how HPKP works, like there's some solution where the ransomer's key/the compromised key can be used to sign another key, and then HPKP pinners that cached the bogus key can now accept it as the new key... but then couldn't you use a compromised key to do the same attack again in the future?)

<comment><USER15> > What would be the fix? I'm asking sincerely as someone who is only surface > level familiar with HPKP, and have never implemented it (but my boss did...)

The fix would be to embed the expected key fingerprint in DNS and have the browser issue either a 2nd request for it or have the DNS server return it as additional data just like when requesting a CNAME record and it returns the A record too. Then, to prevent DNS MITM attacks, have the whole zone and the domain's zonefile signed.

On the other hand, given that DNS is UDP, this opens up the possibility of an MITM attacker simply suppressing the 2nd request for the HTTPS key, or corp firewalls/MITM boxes/crappy provider DNS servers simply filtering out the responses...

<comment><USER16> As the other commenter said, this sounds a lot like DANE.

As such, it suffers from the same issue: it relies on DNSSEC. If you look at the trust chain for DNSSEC on the .com domain, you are trusting the US government and your registrar. The US government is the bigger issue here, as the NSA is also a part of them.

You might argue that this is 'good enough' but considering the momentum that these kind of systems have, a wrong decision here could really enable NSA spying for a long time. Besides, CT logs seem like a much better solution than key-pinning anyway.

<comment><USER17> This has always seemed like a really silly argument. You're already trusting the US government, VeriSign, and a multitude of other organizations that control CAs, so DANE doesn't make this worse.

It's kind of a moot point, though, since DNSSEC is garbage for other reasons. Certificate transparency logs are the current best effort in this area.

<comment><USER16> The point is not that DANE doesn't make things worse. The point is that it is not a solution. Originally, DANE was meant as a method to restrict rogue CA's from issuing certificates. The fact that state-actors can still do that after DANE makes DANE a bad solution.

<comment><USER18> The US Government is and should be the root of trust for US domains (certainly for .us, and de facto that's become the use of .com too). Since the US government can compel any US entity to follow secret orders, if you don't trust the US government you already couldn't use any US sites. DANE improves things compared to not, since it means you don't have to trust the US government if you're not using US sites, you don't have to trust the Chinese government if you're not using Chinese sites, you don't have to trust the government of Kazakhstan if you're not using Kazakh sites...

<comment><USER16> I am a dutch citizen and have a .nl domain. Yet, that does not mean I am ok with the dutch government issuing invalid certificates for my website.

True, it's an improvement that only the dutch government can do this, and not the Hong Kong post office. On the other hand, it is a major downside that we are encoding the possibility of government dragnet surveillance.

In the end, certificate transparency logs will let me notice whenever anyone issues a certificate for my website.

<comment><USER18> > it is a major downside that we are encoding the possibility of government > dragnet surveillance.

Quite the opposite; DANE makes it possible to have a TLD that opts out of giving national governments access to it. Most existing TLDs are controlled by governments, but that doesn't have to be how it is.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> Seems reasonable to remove HPKP.

In my experience the use case that HPKP addresses the best is winning arguments with people who like ssh and think WebPKI and browsers are wrong. HPKP can be used to establish TOFU trust in the leaf key (but you need to pin your _future_ key, too).

Winning that argument isn't worth the risks of HPKP, though.

</comment><comment><USER20> As someone who's completely unfamiliar with the Chrome ecosystem I wonder what Blink has anything to do with this (why is this posted in blink- firstname.lastname@example.com)? Isn't Blink just the rendering engine for Chromium that does DOM/CSS stuff?

<comment><USER21> They used to coordinate security stuff on mozilla.dev.security.policy but they switched to blink-dev, maybe to indicate this is Chrome's/Google's position only. The first big use of blink-dev for security that I remember was the Symantec thing.

</comment></comment><comment><USER22> non-javascript url: [https://groups.google.com/a/chromium.org/forum/?_escaped_fra...](https://groups.google.com/a/chromium.org/forum/?_escaped_fragment_=msg/blink- dev/he9tr7p3rZ8/eNMwKPmUBAAJ)

</comment><comment><USER23> Kazakhstan and probably Russia as well require all TLS traffic to be opened by MITM devices. [https://m.habrahabr.ru/post/303736/](https://m.habrahabr.ru/post/303736/) [https://news.ycombinator.com/item?id=10663843](https://news.ycombinator.com/item?id=10663843) [https://www.google.co.il/amp/s/www.rbth.com/document/1033000...](https://www.google.co.il/amp/s/www.rbth.com/document/103300000000001000150127/amp)

i wonder if other governments are enacting similar rules in one form or the other....

<comment><USER24> That sounds hard to implement.

If it's done by issuing a new certificate for a different key then won't it trigger red flags when certificate transparency becomes mandatory?

Resulting in the CA getting the kick.

<comment><USER4> IIRC the plan was to force users to manually install a root certificate (controlled by the government) on their devices. Local roots are exempt from any CT enforcement. Naturally, you can just not install the root certificate, but if all traffic is intercepted, I'd expect most users to do so to get around the warnings.

<comment><USER24> That probably only works if the root cert is mandated in all OEM installs...

And still you probably won't find any Linux distros with this support.

Note. incepting all traffic sounds expensive and very dangerous, ie. risk or leaking grows when you scale. It's probably better to only use it for select users.

Curious, why future versions of chrome would not force CT for official TLDs?

<comment><USER4> > Curious, why future versions of chrome would not force CT for official TLDs?

This would cause all corporate MitM proxies to fail. Certificates generated by these devices cannot be logged to the CT log servers accepted by browsers (they only accept certificates chaining back to a trusted root). Local roots were exempt from HPKP pins as well, so this is just keeping with existing policy.

</comment></comment></comment></comment></comment><comment><USER25> why not provide an advanced feature that alerts you any time a cert changes, similar to what we get with SSH?

at least then security conscious users could make decisions for themselves.

<comment><USER26> _why not provide an advanced feature that alerts you any time a cert changes_

Because certificates change ... all ... the ... time. Again ... and ... again ... and ... again.

Years ago I tried using a Firefox addon called Certificate Patrol. I spent half my time approving changes. Here's a Stack Exchange question on exactly that topic. It's a few years old; I don't know if things have gotten better:

[https://security.stackexchange.com/questions/41578/why- does-...](https://security.stackexchange.com/questions/41578/why-does-google- ssl-cert-change-so-frequently)

<comment><USER27> > Because certificates change ... all ... the ... time.

Not OP but I do see potential there. I've thought about it before. Try looking at it from a solution perspective rather than from "why don't we already" and "what would the issues be": certs change, yeah, but usually because they (almost) expired. We should check when Let'sEncrypt renews by default (is that 14 days before expiry?) and what common practice is, and go from there in triggering a warning.

And if there is some uncommon reason to roll over (e.g. suspected compromise), a header could be set either in advance or one could be set that signs the new fingerprint with the old key. The new one shouldn't be pinned right away since an attacker might have misused a compromised key, and a warning symbol could be displayed similar to the mixed-content warning. If someone is suspicious and it can't be delayed, they can call their bank (or whatever it is) and they'd know about it and be able to confirm things out of band.

I'm just conceptualizing but I don't see anything that's not easily solved. I think it could be a good addition.

<comment><USER7> The big sites have multiple certificates for a single domain and you will get one randomly depending on what server you happen to it.

</comment></comment></comment></comment><comment><USER28> Can someone explain all this like im 5? I've always wondered what all this was about.

<comment><USER29> On the internet, when you send and receive data, your data gets handled by a lot of different people. In the old days, anybody who handled your data could tamper with it or impersonate anybody else. Cryptography to the rescue.

Suppose "Alice" and "Bob" want to send secret messages to each other, without allowing "Eve" the eavesdropper to read them, even if Eve can intercept the messages.

Traditional cryptography is "symmetric," where both Alice and Bob must share a secret before they can communicate. Symmetric cryptography won't suffice over the internet, because if Alice and Bob had a secure way of sharing secrets, they wouldn't need internet cryptography in the first place.

So the internet relies on public-key cryptography, where Alice and Bob each have a pair of keys (a "key pair"), one "public" key that everyone can see, even Eve, and one "private" key that has to be kept secret. Alice can encrypt a message using Bob's public key that can only be decrypted using Bob's private key.

At first, it might seem like public-key crypto solves the problem completely, but it creates a new problem: how will Alice get Bob's public key? If she asks Bob for his public key over an unencrypted public channel, Eve can intercept it and offer her own public key, acting as a "man in the middle" (MITM).

Luckily, public-key cryptography has one more trick up its sleeve. If you "encrypt" a message using a private key, it can be "decrypted" using the public key. Only Bob (the owner of Bob's private key) can encrypt messages that can be decrypted with Bob's public key, so anything Bob encrypts that way is effectively "signed" by Bob.

If Alice and Bob trust a third party, Charlie, Charlie can sign a message saying: "This is Bob's public key: 12345" and another message saying "This is Alice's public key: 23456". Eve can't impersonate Charlie without his private key. We call Charlie a "certificate authority." (CA)

When you visit an HTTPS website, the site presents a certificate signed by a CA. Your browser trusts a ton of CAs all over the world, many of them run by governments that you may not really want to trust; any of them can use their private keys to impersonate any site on the internet. This is a hard social problem as much as a technical problem.

High-value websites like Gmail, Facebook, or banks may want to say "Here's our certificate, but don't just trust _any_ certificate authority about that. You should _only_ trust Charlie's signature." That's called "pinning" the public key to a certificate authority.

It's a nice idea, but how will Gmail convey that message to its users? If Eve is a hostile government who intercepts messages and owns a trusted CA, they can impersonate Gmail, saying "Oh, you don't need to trust Charlie exclusively. You can trust any CA, even me."

Chrome comes with a static, hard-coded list of pinned keys for high-value sites, but that can't scale. They had the idea of allowing anybody on the internet to pin their keys, "dynamic" pinned keys or HTTP-based key public key pinning (HPKP).

The problem is, if you pin your public key and you need to change it for some reason, or if you need to switch certificate authorities for any reason, you're in big trouble. People have used HPKP and brought their site down, unable to bring it back up again, because browsers don't trust their new valid key.

As a result, very few sites used HPKP, so the Chrome team is planning to remove it.

Surprisingly to me, they even plan to remove the _static_ list of pinned keys, in favor of "Certificate Transparency" where it's publicly obvious which CAs are signing which certificates. Rogue CAs would then have to reveal that they've gone rogue, at which point browsers could revoke their automatic trust in them.

<comment><USER28> That's an amazingly AWESOME answer, thank you. So... what's an example of a CA that the most highest value targets on the internet trust? (like Google, Facebook, Amazon, and various banks). Is there like a very trustworthy company that handles most of the big companies?

<comment><USER30> There's a list of pinned CAs at the top of the hsts preload list [1]. Which gives you an idea of who might be trusted.

Cert pinning is pretty nasty if you get it wrong. If you don't pin, there's a large number of CAs in most client's default trust stores. If you do pin, and the CA you pinned turns out to be bad, it didn't help. If you pin, but the CA stops issuing from the intermediate or the root that you pinned, you can't get a new cert (hope you had other options); note that CAs don't give much guidance about what to pin. If you pinned a CA that gets delisted, that's no good either. If you pinned two different CAs (a smart choice), but they merge, you no longer have a backup. So, you should pin a public key that you haven't gotten a cert with yet, and keep it safe,but also readily available for emergencies. But you only get one emergency -- hope your next emergency comes after you have time to figure out new pins and get them bundled everywhere; and in the meantime you have one key for everything, which isn't great.

(Based only on the name) Expect-CT doesn't provide nearly as much protection, any CA cert will work, but only if it was publicly recorded. If you monitor for certs issued on your domains, at least you know to raise a fuss if a CA you didn't authorize issues on your domains. That's probably enough to keep CAs in line, unless Let's Encrypt drives the net present value of a well distributed CA to below the value of illicit certificates.

[1] [https://chromium.googlesource.com/chromium/src/net/+/master/...](https://chromium.googlesource.com/chromium/src/net/+/master/http/transport_security_state_static.json)

<comment><USER28> Maybe this is a dumb question... but do larger companies like Google attempt to set up their own CA so they can be sure of the longevity and security, and not rely on a 3rd party?

<comment><USER30> Google is the only one I'm aware of. Microsoft has an intermediate CA, but it's not clear if that's actually independent of the CA that signed it.

It's likely different if you only serve requests for clients you distribute, and can bundle a CA cert. But if you're serving browsers, you need your CA in the default trust store which means passing audits, which is time and money and requires a fairly rigorous setup. If you do that, you still need to get your CA cross signed by an existing CA to use it, until the root is widely distributed, if you support mobile browsers, it's a long wait until you're really distributed. I don't know how much a CA charges to cross sign, but I would guess it's very expensive; and using the cross signed cert means sending an extra cert during tls handshake. There's an extension for clients to indicate supported CAs, but it's not really used, I'm not sure it's very sensibly designed -- anyway there's not a good way to know and then provide different certs for clients that don't know your CA.

</comment></comment></comment></comment></comment></comment><comment><USER31> Is there an alternative to prevent people from doing MITM attacks on mobile apps? With HPKP running, apps with Charles requires a rooted device.

<comment><USER32> For mobile apps it's _easier_ than for websites because native apps have more control over what's going on than the website, and can read the details of http connections (so in worst case, you can roll out your own pinning).

For Android there are a built-in facilities for that in modern versions: [https://developer.android.com/training/articles/security- con...](https://developer.android.com/training/articles/security-config.html)

For iOS: not an expert, but this article seems good [https://dzone.com/articles/ssl-certificate-pinning-in-ios- ap...](https://dzone.com/articles/ssl-certificate-pinning-in-ios-applications)

It might get a bit trickier when WebViews are involved though because, at least on Android, SSL in WebView is subject to different security rules than the java-initiated connections (AFAIU the problems due to [https://www.chromium.org/developers/androidwebview/webview-c...](https://www.chromium.org/developers/androidwebview/webview- ct-bug) could not have been avoided on the app side, for example, as it was a bug in Chromium).

<comment><USER33> > It might get a bit trickier when WebViews are involved though because, at > least on Android, SSL in WebView is subject to different security rules than > the java-initiated connections

They've started changing that:

[https://developer.android.com/about/versions/oreo/android-8....](https://developer.android.com/about/versions/oreo/android-8.0-changes.html#o-sec)

</comment></comment></comment><comment><USER34> Without key pinning, are threre other options for site operators to protect their users from MITM by traffic monitoring appliances?

<comment><USER33> HPKP doesn't protect against MITM via locally installed trust anchors. It explicitly permits that in both Chromium and Firefox.

</comment></comment><comment><USER35> The same as with 301, everyone recoomends them until they buy a domain or do some restructuring with new people some years down the line and 301 totally messed their site up without any reset button.

<comment><USER32> Can you explain this more?

<comment><USER36> HTTP provides a couple of different response codes for when one URL should redirect to another URL. The most common are 301 Moved Permanently and 302 Found, aka moved temporarily.

When designing a website and you find the need to redirect one URL to another, you have to choose which HTTP response code to use for the redirect. You might naively think 301 Moved Permanently is the right choice for when you perceive the redirection to be a non-temporary thing. Unfortunately HTTP 301 responses are cached _very_ aggressively by web browsers by default, so if you install a 301 redirect in your website and choose to revert it, clients who have already seen the now-reverted 301 redirect will just keep following the cached redirect.

Basically, unless the URL you're redirecting is receiving way more than a thousand hits per second (i.e. unless you're running a large-scale website with lots of traffic), you should _always_ use the temporary 302 redirect, even though you might perceive the redirection to be non-temporary.

<comment><USER35> Thanks for doing what would have been my job. Appreciated.

</comment></comment></comment></comment><comment><USER37> What about supporting client side certificates in HTTP2?

<comment><USER38> Less a Chrome policy thing and more a "Nobody has suggested a solution the working group making the standard likes enough, so there isn't even a defined way how". So unless I missed a recent development, don't expect it to happen.

</comment></comment><comment><USER39> Ah, Google. The tech gods giveth standards, and the tech gods taketh standards away.

This is what happens when you let a single vendor define web standards, and have a majority share of the browser market. They can take their toys and go home, and websites won't support what they don't support.</comment>


By reading this page, you are mining bitcoins - <AUTHOR> http://qz.com/154877/by-reading-this-page-you-are-mining-bitcoins/ <comment><USER2> I had a similar idea a little while ago that takes advantage of using the HTML5 Webworker API to run a Javascript Bitcoin mining script to create a Bitcoin bot-net of sorts. It is interesting though, at least this has a button and seems to run differently.

Of course I wouldn't advocate doing such a thing beyond proof-of-concept or you could find yourself in trouble if found out.</comment>


2^3^4 - a comparison of math packages - <AUTHOR> https://plus.google.com/u/0/104277466162910953762/posts/e3jCt51VfmD

<comment><USER2> This is exactly why when ever I need to do any sort of math in a program I make sure to put parens around any single operation. Even 2*2+2 gets the treatment because god knows there have been people who screwed that up.

<comment><USER3> > Even 2x2+2 gets the treatment

2+2x2 I can see (Smalltalk has strict left-to-right evaluation of operators, so it parses as (2+2)x2), but for 2x2+2 to give the "wrong" would require `+` to have a higher precedence than `*`, something I've yet to see (short of abusing haskell to redefine the operators with fucked up precedences)

edit: god fucking dammit HN can't you get any markup right?

<comment><USER4> If I recall correctly, APL executes right to left -- so it would return 8 for 2*2+2.

<comment><USER3> Neat, I'd forgotten languages could execute RTL as well.

</comment></comment></comment></comment><comment><USER5> It makes more sense for 2^3^4 = 2^(3^4). If you meant (2^3)^4, then it would be more efficient to calculate 2^(3*4), because exponentiation takes much longer than multiplication.

On a related note, in Excel, -1^2 = 1 because they are calculating (-1)^2 instead of the more standard interpretation, -(1^2).

<comment><USER6> Incidentally, I mentally parse -1^2 as (-1)^2, but I parse -1² as -(1²). Reading your post I was thinking "well yeah, minus one squared is one, what else would it be?"

</comment></comment><comment><USER7> All of the "4096" results have exponentiation as left-associative, despite the common conventions that exponentiation is right associative.

Seeing the example really makes me wonder why that convention exists, and also makes me ponder whether having variate associativity is actually a good idea after all. Especially in languages like Scala, where you can change the associativity of your binary functions through function naming.

Though I can see why things like the cons operator "::" make a lot of sense.

<comment><USER8> It's interesting to think that the whole notion of associativity and order of operations only exists because for some reason humans seem to find infix notation more "natural" for binary (or fixed arity) operators than more easily parseable and less ambiguous alternatives like prefix.

<comment><USER9> ^ ^ 2 3 4

Prefix notation doesn't automatically solve the problem, you need to assume an evaluation order. More specifically, you need to not assume associativity.

<comment><USER8> Isn't the lack of associativity explicit in prefix notation? Prefix notation doesn't even contain the notion of order of operations. You would convert the infix "2^3^4" to prefix in different ways depending on the associativity of exponentiation:

For left associativity (uncommon):

        ^ ^ 2 3 4

For right associativity (common):

        ^ 2 ^ 3 4

Of course, all this is assuming all operators are fixed arity, otherwise you need parentheses no matter what.

</comment></comment></comment></comment><comment><USER10> Common Lisp FTW:

            ? (expt 2 3 4)
            > Error: Too many arguments in call to #<Compiled-function EXPT #x3000000A6C2F>:
            >        3 arguments provided, at most 2 accepted.

<comment><USER11> And thus forces programmer to think about the order of non-commutative operations.

<comment><USER8> The fact that infix notation removes the need to think about that is a bad thing, because infix notation is inherently ambiguous unless you litter the expression with parentheses or explicitly think about operator precedence and associativity. Infix notation just _appears_ to be easier on the mind, because we're first taught arithmetic using it.

</comment></comment></comment><comment><USER12> Not a comparison, just "does ^ bind to the left or the right in different software?"

<comment><USER13> But they shouldn't bind a^b^c to (a^b)^c without parentheses.

<comment><USER3> That's exactly the difference between binding to the right and binding to the left (aka left-associativity and right-associativity). A left-associative exponent will parse to `(a^b)^c`, a right-associative one will parse to `a^(b^c)`

<comment><USER13> What I was trying to say is that parsing exponents like that makes as much sense as parsing a+b* 2 to (a+b)* 2.

<comment><USER9> No, it makes as much sense as parsing a* b* 2 to (a* b)* 2.

</comment></comment></comment></comment></comment><comment><USER14> On a very unrelated note when I type "(2^3)^4" in google i get "4 096" and when I type "2^3)^4" I get "4096" (notice a space gone)

<comment><USER15> (4000+1.1 has a space and (4000+1 doesn't, not sure what that means.</comment></comment>


Ask HN: is Co-CEO a viable option? - <AUTHOR>

My company currently has 3 founders, however, myself and another co-founder want to split the title of CEO. Is this a viable solution or are we just setting ourselves up for failure?
Some background on our situation: I have lived with my co-founder for the past 2 years being roommates. I've also known him for over 5 years. We have very similar strengths and backgrounds, and share a common vision for our company. The decision ultimately came up to split the CEO title because no clear leader could be easily determined and we both have the skills required to be a good CEO (such as being able to easily speak with outside investors)
There have been several large companies with CO-CEOs, RIM, Motorola, SAP, etc...so we feel like it's not that uncommon.
I've read a lot of negative criticism on co-CEOs but I'm curious what the HN community thinks on the subject. <comment><USER2> "because no clear leader could be easily determined"

this should answer your question right there (imho). there always needs to be a clear leader.

<comment><AUTHOR> I mean... theoretically, we could lock ourselves in a room and keep discussing and have a final vote to see who is CEO and that would solve our problem.

The issue is that I'm afraid how the person who didn't become CEO would feel, especially if they were equally as deserving. From a founder's standpoint, it's hard to say that one person is better than the other when both people have been there from the beginning and contributed equally as much to the venture.

</comment></comment><comment><USER3> Stick two pieces of paper "CEO" and "CTO" in a hat, shuffle it around.

Get a coin, have your 3rd guy flip it. Head's you get the first paper, tails your partner gets the first paper.

Have your 3rd guy pick a paper from the hat.

Problem solved, now focus on the shit that actually matters.

</comment><comment><USER4> By 3 founders, I take it you don't have any other employees. If your company only has 3 people in it, then I wouldn't be worrying about titles at this stage. Focus on getting your product up and out instead.

<comment><AUTHOR> Yes, but after we've incorporated and received funding, the legal docs require executive positions.

</comment></comment><comment><USER5> Bigger problem is having too many founders. You guys have much bigger problems than titles. You now need 3x revenue.

<comment><AUTHOR> 3 heads are better than 2?

haha at this point, that's not something we can change... so let's hope for 3x the revenue ;)

</comment></comment><comment><USER6> Make someone president and someone CEO and split up who has say in what area when you two disagree on something. Somebody needs a veto vote or it won't work and you won't be able to move forward.

<comment><AUTHOR> right now, our 3rd member acts as the decision making party if co-ceos can't agree on a decision. This hasn't come up very often though.

We feel president does not really hold the same sort of title and impact as the CEO.</comment></comment>


Show HN: Seetly – a tool for capturing and sharing information in your images - <AUTHOR> https://www.seetly.com/?referral=hackernews <comment><USER2> Images + spreadsheet? This is strange, but I see it being very useful (I just realized this utility after reading the use cases on the landing page, but I wouldn't use it the way it is shown on the actual examples).

The problem will be to drive adoption of such a strange new concept.

<comment><AUTHOR> I agree. I've got a handful people using it for the small offices, a lot of the everyday items they were keeping track of using spreadsheets tied to some desk number. We are exploring what other applications this could be used for, a big one was event planning. What were you thinking it could be used for?</comment></comment>


There are going to be lots of dead unicorns - <AUTHOR> http://www.ft.com/intl/cms/s/0/9312e100-f71c-11e5-803c-d27c7117d132.html <comment><USER2> Anybody have a non-paywalled version?

<comment><USER3> [https://www.google.com/#q=http:%2F%2Fwww.ft.com%2Fcms%2Fs%2F...](https://www.google.com/#q=http:%2F%2Fwww.ft.com%2Fcms%2Fs%2F0%2F9312e100-f71c-11e5-803c-d27c7117d132.html)</comment></comment>


Figma's Story – The Thiel Fellowship Application - <AUTHOR> https://www.linkedin.com/pulse/figmas-story-part-1-my-thiel-fellowship-application-2011-dylan-field <comment><USER2> Wowed by the overall application. Wish I had half the smarts or quarter the thoughtfulness. No wonder Figma is such and amazing and delightful tool.

Its really insightful to see other's entrepreneurship journeys and find out that even the most successful entrepreneurs did not have a straight path forward. There are so many highs and lows, sometimes in the same day. It is really easy to bogged down in the lows and similarly get too hyped up by the highs. Nowadays just trying to keep a level head through both, keep the focus on the next problem to solve and trusting others to do their job.

Completely disagree about chocolate though :p

<comment><AUTHOR> >> Tell us one thing about the world that you strongly believe is true, but that most people think is not true. If this belief shapes the way you live, tell us how.

I'm curious to know the variety of answers we can get from that question. What's your take on that ?</comment></comment>


MicroG – Re-implementation of proprietary Android apps and libraries - <AUTHOR> https://microg.org <comment><USER2> I'm glad this is still being maintained. It's a really great way to still run popular apps without having to go the entire F-Droid/OSS only route.

My current phone no longer charges and I've already replaced so much stuff on it (back, camera, etc.) that I'm deciding to go the KDE Plasma route, starting with a new old-stock Nexus 5X.

I hope the Purism 5 and Pinephone get released as well. I really want to go the Plasma route. If there is tooling I need that's missing, I hope it will force me to write and contribute apps that can help myself and others.

We need a real open source mobile operating system, not Google's cripple-ware.

<comment><USER3> Watch out for the 5x, I've seen 3 in addition to mine die the same way. They start rebooting randomly then boot loop. It's an acknowledged problem with the chipset. You can sort of fix it if you are able to load an alternative kernel [0] on it that disabled the big cores and that bought me another few months before it totally died. If you're willing to risk it you can get a higher RAM version of the motherboard on aliexpress where they may have used better solder.

[0] [https://www.xda-developers.com/nexus-5x-bootloop-fix-boot- ph...](https://www.xda-developers.com/nexus-5x-bootloop-fix-boot-phone/)

<comment><USER4> I was planning on keeping my 5X for years and years, but it died on my this same way

<comment><USER5> I must have got lucky because mine still works fine and I use it daily.

<comment><USER6> There are dozens of us!

</comment></comment></comment></comment></comment><comment><USER7> MicroG is a fantastic project! I wouldn't know what to do without it! (×)

For anyone who wants a really easy way to install and use LineageOS with MicroG, consider going for the MicroG-infused version of LineageOS: [https://lineage.microg.org/](https://lineage.microg.org/) It's basically pure LineageOS with a small patch that allows MicroG to spoof the Google services' signatures. The ROM supports all the devices regularly supported by LineageOS and even gets weekly OTA updates, too.

(×) In case you agree, consider donating to the project: [https://salt.bountysource.com/teams/microg](https://salt.bountysource.com/teams/microg) (or, if you want a specific issue to be solved, you can put a bounty on it, too: [https://bountysource.com/teams/microg](https://bountysource.com/teams/microg) )

<comment><USER8> I'm getting tempted to go the LineageOS with MicroG route on my Pocophone (need to confirm it works first).

Does this mean I can use the Play store and apps such as Spotify without much issue?

<comment> m-p-3 You could also use the Yalp Store (Play written in reverse) to grab the APK without having the play store installed.

[https://f-droid.org/app/com.github.yeriomin.yalpstore](https://f-droid.org/app/com.github.yeriomin.yalpstore)

<comment><USER9> Yalp is currently abandoned, try using Aurora Store instead: [https://f-droid.org/app/com.aurora.store](https://f-droid.org/app/com.aurora.store)

<comment> m-p-3 I didn't know that, thanks!

</comment></comment></comment></comment></comment><comment><USER10> Most of the proprietary Google apps on Android are actually just frontends to their proprietary network services like play, maps, gmail, gms, firebase, etc. Giving a replacement that deserves the name means that you have to re-create the associated network services which is the actually hard part because you won't just get shop owners to upload their opening hours to your service as well as google maps. That's an immense competitive moat that Google has built. It's on the territory where they are strongest, providing network services. And it's part of the reason why they could open source the Android OS in the first place: no competitor manages to replicate all of those network services.

<comment><USER11> > You won't just get shop owners to upload their opening hours to your service > as well as google maps

Over the last couple of years, I have noticed some shop owners (mainly chains, but also individual proprietors) adding their opening hours to OpenStreetMap themselves. Certainly more needs to be done to compete with Google, but OSM is still a libre alternative with some level of uptake. Plus, anyone walking past an establishment can add its opening hours from what the sign on the door says.

<comment><USER12> I add opening hours to establishments I frequent. Since next time, I can easily answer the question "Is X open right now?" without needing to be online to do so.

</comment></comment></comment><comment><USER13> I recently looked at this while reviving a trusty old Samsung S4, but ultimately just went with Enhanced LOS and no gapps. F-Droid has pretty much everything I really need. It's kind of amazing how well supported this stuff is by the community, I am tempted to move away from the Apple ecosystem for my regular phone.

<comment><USER14> I'm curious how well this went - The microG site says that some OSS apps are requiring Google libraries.

Have you run into a problem here?

<comment><USER15> In my experience (running Lineage + microG for a month or so now) the main issue is with in-app purchases like "Pro" versions of things or subscriptions. There are various workarounds to make it happen, but I haven't had any success. I've tried using the NanoDroid patched Phonesky apk but no luck on my Pixel.

Some apps attempt to check their license via PlayStore on startup and won't acknowledge your license otherwise (e.g. TitaniumBackup, DarkSky) Others require play services to download additional stuff and refuse to function without it - e.g. Monument Valley.

Some work fine when the pro version is restored via TitaniumBackup, though - Solid Explorer is one example.

</comment></comment></comment><comment><USER16> Google requires a comprehensive privacy policy for apps and there are plenty of policy generators, but they don't make their own library specific privacy policies easy to find in my experience. Just using Google Play has privacy implications and it's a mess trying to track down and link proper policies without seeming like your app is stealing users social security numbers. It's possible I just have no idea what I'm doing, but I shouldn't need to hire a lawyer for an app that collects zero data by itself.

</comment><comment><USER17> A downside to MicroG is that it relieves some of the demand coming from people averse to Google snooping, so there's less demand for a genuine alternative.

Running MicroG makes you still under Google's thumb.

Additionally, Google can pull the rug out from under you at any time (by breaking MicroG with technical changes, or ToS).

(Personally, I've temporarily switched to a dumbphone for essential voice/SMS, while PostmarketOS gets developed for various Web/app purposes, and am also looking at the Librem 5 work.)

</comment><comment><USER18> I'm using this on a HTC 10 for 9 to 12 months now (on an inofficial LineageOS build). Only major quality of life issue is the lack of system-wide weather data (e.g. Garmin Connect is unable to display weather on my fitness tracker). Minor annoyances are the absence of the pretty good Google Maps (though I've heard good things about Here Maps on HN) and that Volvo on Call seems to have some trouble with rendering the replacement OSM map data; but I only installed VoC recently, so I could not check this on a Google-infected Android, plus that feature is not that important (and if I'll ever be too drunk to find my car that's probably a good thing after all).

Two friends of mine migrated from Windows Phone directly to Samsung Galaxy S... uhm, not sure, 8 or 7 I think... with LineageOS+MicroG, and are quite happy as well.

<comment><USER7> > Minor annoyances are the absence of the pretty good Google Maps

I don't understand. What prevents you from installing Google Maps on your phone? It works perfectly fine on mine. (I'm running the MicroG-infused version of LineageOS. [1])

[1] [https://lineage.microg.org/](https://lineage.microg.org/)

<comment><USER19> The goal of some MicroG users is to completely remove all Google apps. It's more a matter of preference and principle than the app not working.

Also, Maps is constantly harvesting location data and beaming it back to G servers, something many MicroG users are explicitly trying to prevent.

<comment><USER20> I'm still disappointed by Google's ongoing refusal to implement "allow only while in foreground" permissions to apps (for things like location).

</comment></comment></comment></comment><comment><USER21> What are - if any - the security implications of the signature spoofing that MicroG requires? I've considered trying to squeeze MicroG into GrapheneOS, but GrapheneOS currently doesn't support signature spoofing. LineageOS does, but unfortunately my device isn't supported by LineageOS.

<comment><USER15> If an app has the permission to spoof signatures (which must be specified in its manifest - I.e. it's not a permission that's grantable with `pm` ) it can spoof itself as being any other app, if my understanding is correct. This opens the door to sketchy apps pretending to be system apps, then man-in-the- middling your data, potentially leaking sensitive info, etc.

Generally the signatures are there as a tamper-proofing mechanism. Some builds (e.g. official-ish LineageOS for MicroG ROMs) have a hardcoded notification that's shown for the signature spoof permission so it can't happen in the background, though.

The possibility of widening the attack surface just triggers security paranoia in those of us ditching Big G for privacy reasons - that's why there's controversy over it at all.

</comment></comment><comment><USER22> \- MicroG felt somewhat unmaintained, it took months for my bugfix PR to get merged. Maybe it's better now? idk... Nanodroid's fork was more active at the time, but idk if it's trustworthy or still active.

\- Getting SafetyNet to pass on Lineage-MicroG required installing the pirate/ad-remover app Lucky Patcher (which comes with some questionable adware) and using it to patch away APK installation signature checks. Lineage- MicroG's built in spoofing doesn't work.

\- Hangouts would crash at launch unless you disabled some https/pinning/etc. I heard it was fixed.

</comment><comment><USER23> Something I've wondered- does this allow you to totally forego Google's web APIs? I.e., sending any data to Google at all? Or is it just that the local code is open source?

<comment><USER7> AFAIK MicroG doesn't send any data to Google unless you explicitly tell it to. Here are some situations where you might want to do that:

\- You might want to enable the Google Cloud Messaging feature inside MicroG, so that your apps can receive push notifications just like they would on a regular Google phone.

\- SafetyNet. If you want some app to work that requires Google SafetyNet, your phone will necessarily have to communicate with the Google servers. MicroG provides functionality to do that. (Though, if you're worried about your phone's security, I strongly advise against using this feature because SafetyNet essentially requires the phone to download and run a binary blob from the Google servers.)

\- If you want to install apps from the Play Store you will have to install the Google Play Store app or at least some open-source alternative like YalpStore or Aurora Store both of which will obviously download the .apks from and therefore connect to the Google servers. However, this has nothing to do with MicroG per se.

Anyway, you decide all this for yourself. If you don't want your phone to connect to Google _at all_ , that's perfectly possible.

UPDATE: Indeed, I just checked and found a setting in MicroG saying "Allow connecting to Google servers. If disabled, all connections to Google servers usually done by microG will be denied. This overrides service-specific settings."

<comment><USER24> One of the key benefits to MicroG is that you can turn on/off Google Cloud Messaging for every single app that uses it. As far as I'm aware, this fine- grained permission is not available on Google Play Services.

</comment></comment></comment><comment><USER25> While this is cool (and old), it is only a band-aid... it would be much better if the mobile apps would be native linux apps or maybe web-apps

</comment><comment><USER26> This worked great when I had an android (I replaced with an iPhone since I wanted easy privacy).

Worked for most things, the maps and location part was most dodgy though. Uber was almost impossible to use and Grindr stopped working. Other than that, things like G/FCM worked perfectly.

<comment><USER27> > I wanted easy privacy

> Uber [..] Grindr

Can I just comment how contradictory this is? I understand "privacy" means different things to people, but when used like this it's diluted to an arbitrary buzzword. What I mean is:

Grindr Shares Personal Information With Third-Parties: [https://news.ycombinator.com/item?id=16735956](https://news.ycombinator.com/item?id=16735956)

Uber pulls U-turn on controversial tracking of users after trip has ended: [https://www.theguardian.com/technology/2017/aug/29/uber-u- tu...](https://www.theguardian.com/technology/2017/aug/29/uber-u-turn- tracking-users-after-trip-ended-app-user-privacy-new-ceo)

Uber has user route history, payment history, etc, and law enforcement is readily utilizing this data, e.g. in the recent Jussie Smollet fiasco, in cases. Even if you're not worried about that, Uber had a massive data breach, which they were investigated for and fined.

<comment><USER28> A lot of people have problems with some privacy violations but not with others. Until recently, I trusted Google with my data but not Facebook, because I felt I knew how Google operated.

Since then, Google has lost my trust, and now I'd like to restrict their access to my data.

</comment></comment></comment><comment> m-p-3 Is that something a company like Huawei could use to skirt around the Google ban?

<comment><USER5> Maybe. Google could probably find a way to block it if they tried. A lot of this custom android stuff only works because Google put no effort in to stop it.

</comment></comment><comment><USER29> Response to the Huawei ban?

<comment><USER30> Nope, this is quite an old and mature project. Maybe it'll grow more in response to that.

<comment><USER29> An appstore equivalent would allow developers to bypass the appstore revenue cut.

<comment><USER31> what is this in response to?

The App Store is a different ecosystem running on a different operating system designed for different hardware owned by a different company entirely?

<comment><USER29> I believe that Huawei no longer will have access to Google Play.

<comment><USER32> [https://appstore.huawei.com/](https://appstore.huawei.com/) ?

<comment><USER29> Sure this is Huawei's store, but if you were born in Europe, there's no chance that you would download something from here. [https://www.nytimes.com/2019/05/20/business/huawei-trump- chi...](https://www.nytimes.com/2019/05/20/business/huawei-trump-china- trade.html)

<comment><USER32> I think so too, so I guess you realize that simply having an app store is not enough to actually replace Google Play.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER33> It would be cool to remove the original stock Google Layout and replace with microG without wiping the phone and installing a custom ROM

</comment><comment><USER34> Now if I could find a working ROM for my Landvo V1 (failed rooting)... That would be a nice thing to play with

<comment><USER35> I imagine you've already tried [https://lineage.microg.org/](https://lineage.microg.org/)?

<comment><USER34> Since it's a cheap chinese phone, unless I find my self with the talent and motivation to do a port myself, nothing support it.

<comment><USER15> Google around for a project called NanoDroid (I'm not affiliated)

That guy has released a ROM patcher for most AOSP ROMs that can add in signature spoofing support. IIRC there was also flashable tooling for removing GApps from your device.

You'd need a custom recovery, though. Just flash your stock vendor image, remove GApps, flash the patcher, then flash microG. I'm simplifying a bit, but it might be possible.

[https://forum.xda-developers.com/apps/magisk/module- nanomod-...](https://forum.xda-developers.com/apps/magisk/module- nanomod-5-0-20170405-microg-t3584928)

[https://gitlab.com/Nanolx/NanoDroid](https://gitlab.com/Nanolx/NanoDroid)

<comment><USER34> That's the thing: there is no (working) stock vendor image for it.

</comment></comment></comment></comment></comment><comment><USER36> Not an Android dev here... What's the IPC mechanism used to communicate with those services?

<comment><USER37> The version of the Linux kernel used in Android implements a custom IPC mechanism called Binder that userspace services and apps use, which I think (though I could be wrong) is based on some kind of also custom-made shared memory facility.

</comment></comment><comment><USER38> would be awesome to be able 'play services' implementation like you select launcher, without the need to rely on Google (and one woild select microG, which works great... and push is optional)

</comment><comment><USER39> Didn't read the article, but people reading the article might be interested in Termux: [https://termux.com/](https://termux.com/)

</comment><comment><USER40> Doesn't work anymore on my Galaxy S10 Plus :(

</comment><comment><USER41> Huawei would hope this could be used. Definitely.

</comment><comment><USER42> Look like dead project

<comment><USER14> Their Github (github.com/microg) shows activity over the last month. What gives you the impression it's dead?

</comment></comment><comment><USER43> Can anyone comment on Dutch attitudes in this respect? The Dutch I have worked with could come across as very confident - even when very obviously wrong. I've found it a little confusing: they sound like they're right, but what they're saying is incorrect! In Anglo culture people tend to be a little more circumspect when there is the potential to be wrong.

I had a Dutch boss, who once said, "you never put forward something as your opinion, you always state a secondary source. Why?". I said it was to give credence to what I was saying, because I myself am only one data source. His answer was, "oh, that is very honest". I never really understood that.

<comment><USER32> It looks like you're posting in the wrong thread.

<comment><USER43> So I did. How did that happen?</comment></comment></comment>


Ask HN: How do you attract clients/customers? - <AUTHOR> <comment><USER2> For our logo design company ([http://fairpixels.co](http://fairpixels.co)), we open source our unused logo designs on [http://logodust.com](http://logodust.com) and make them available for free. We promote Logodust to bloggers/reporters and have gotten some publications on sites like TheNextWeb. A good chunk of those visitors then upgrade from the free logos to a paid, custom design. We have a pretty healthy and consistent flow of visitors to Logodust so paying clients knock on our doors consistently.</comment>


Known Dark Matter Isn't Enough - <AUTHOR> http://briankoberlein.com/2014/08/19/known-dark-matter-isnt-enough/

<comment><USER2> I like the idea of black holes being more common. If there is one close we could visit it someday and yet it doesn't pose any danger to us, since there is no chance that it is in our solar system.

Given the ratio of one black hole per 1000 stars, which is the best we can guess right now, the average distance to the closest black hole is 36 lightyears.

<comment><USER3> There's a chance one might _pass through_ , which seems very alarming to me. It also seems like we'd have observed interactions between such black holes and other stars pretty frequently.

I don't know if we'd have expected to have seen lensing effects from our whole-sky surveys, but it seems to me that this would also be probable.

Finally, if you send a line through our galaxy, you'd expect it to pass near a lot of these black holes -- and thus you'd expect to see a lot of microlensing effects which the article states don't seem to occur nearly often enough.

<comment><USER2> I wouldn't worry myself with that. Since a black hole behaves exactly like a normal star at a large distance, the chance is very small, even if there are many of them. For example, when our galaxy merges with Andromeda there will be only ~1 star collision.

Normal black holes are really small, much smaller than a planet, which we can barely detect now. And those planets must be orbiting a star and in the correct inclination to be detected.

<comment><USER4> Stellar mass black holes are small in size, but supermassive black holes can be larger than our solar system. Fortunately for us they only exist in the centers of galaxies. The closest supermassive black hole to us is 30,000 light years away.

<comment><USER3> Also even small (stellar) black holes are very massive — 5x sol and up — (since they tend to occur from the collapse of very large stars) so having one pass near or through the solar system could be catastrophic.

Primordial black holes are posited to be possibly so small as to be able to pass through the earth without interacting with more than a few atoms, which would make visiting them both difficult and not enormously interesting.

Edit: clarification and added info on primordial black holes which I looked up.

</comment></comment></comment></comment></comment><comment><USER3> Nice survey of dark matter candidates. I had not heard about the primordial black hole option.

<comment><USER5> The next part, linked now at the end, is also informative: [http://briankoberlein.com/2014/08/20/already-know-quite- bit/](http://briankoberlein.com/2014/08/20/already-know-quite-bit/)

Especially for the graph taken from [http://arxiv.org/abs/1112.1320](http://arxiv.org/abs/1112.1320)</comment></comment>


Computers Evolve a New Path Toward Human Intelligence - <AUTHOR> https://www.quantamagazine.org/computers-evolve-a-new-path-toward-human-intelligence-20191106/ <comment><USER2> Intelligence is realizing and living in our true position of fragmental portion and servant of the Supreme Person.</comment>