A Case for Safe Eval - <AUTHOR> https://github.com/robert-j-webb/stackedit/blob/master/safe%20eval.md <comment><USER2> Rather than trying to sanitize the input to 'eval', why not just write a separate expression evaluator? Then you can know for sure that there's no way to craft an input that causes an arbitrary function call, because your evaluator has no way to make an arbitrary function call. Also, you can define whatever operators you like.

This use case doesn't seem to me to be one that's likely to arise often.

<comment><USER3> Everything old is new again.

[http://search.cpan.org/search?mode=module&query=Safe](http://search.cpan.org/search?mode=module&query=Safe)

<comment><USER4> Why stop at Perl? DSLs and limited environments are almost as old as Lisp.

</comment></comment></comment><comment><USER5> > Additionally, (() => 5)() doesn't work because we don't allow open and close > parens next to each other.

Not really, I can write

      ((/**/)=>5)(/**/)

Using eval on data that are provided by a user is always a bad idea. You cannot be sure that your sanitiser will be safe with new syntax elements.

<comment><USER6> Or simply use the replacer to generate what you want - include illegal characters like letters, and once they get removed, you get what you want: `((x)=>5)(x)` becomes `(()=>5)()` once the x is removed.

I don't see a way to exploit it, but that means very little (as shown by the fact that the author missed this one).

<comment><USER7> > include illegal characters like letters, and once they get removed

Removing characters you know to be illegal and then trying to run it anyway is asking for trouble. If it contains illegal characters, it should fail immediately.

</comment></comment></comment><comment><USER8> > This is very quickly becoming a huge pain for me to write. I have to write a > compiler, and a lexer. I have to continue extending this for each new kind > of operator added.

Counterpoint: good luck getting that magical regex to scale to many new operators. Or other data types, for that matter. What if, for instance, you wanted to add support for strings? Suddenly, the entire original approach is useless and building a tiny compiler is the best and safest option.

It also the case that, as olegbulatov demonstrated, you're fighting an uphill battle trying to sanitize code with a regex. There's really not reasonable way to prove with 100% certainty that a regexp blocks _all possible expressions_ that could do nasty things. Writing a tiny compiler might be a pain in the ass, but you can be very sure of the safety that it offers....and it doesn't need to use eval().

<comment><USER9> Yup. Sanitizing arbitrary expressions is even harder than sanitizing sql expressions. After years of seeing how regex based sql injection prevention doesn't work we shouldn't apply the same things here.

</comment></comment><comment><USER10> This seems like just another form of string trepanation: [https://thoughtstreams.io/glyph/string- trepanation/](https://thoughtstreams.io/glyph/string-trepanation/)

You're trying to get the evil out of the string, at which point the remainder of the string is good. That's not how strings work. If it happens to work now, who knows what syntax will show up next year (and there are plenty of examples on this page of working around the regex). You're in a constant battle of figuring out whether bytes are good or evil when the actually answer is they're neither.

Full recognition before processing! [http://langsec.org/occupy/](http://langsec.org/occupy/)

</comment><comment><USER11> In the E family, cousins to ECMAScript, the eval() function _is_ confinement- safe and cannot access objects which it hasn't been given explicit access to use. The proof actually can be extended to any lambda calculus which doesn't have global mutable state.

Edit: I should add that the crux of the technique involves a two-argument eval() with an explicit environment, as opposed to the single-argument eval() of ECMAScript.

<comment><USER12> The problem is that you need to sandbox prototypes et al

[https://en.wikipedia.org/wiki/JSFuck](https://en.wikipedia.org/wiki/JSFuck) [https://stackoverflow.com/questions/2669690/why-does- google-...](https://stackoverflow.com/questions/2669690/why-does-google- prepend-while1-to-their-json-responses)

<comment><USER13> I can't believe nobody else pointed out JSFuck.

Try the converter at [http://www.jsfuck.com/](http://www.jsfuck.com/) \-- or browse the esolang entry: [https://esolangs.org/wiki/JSFuck](https://esolangs.org/wiki/JSFuck)

Spoiler: it can do everything normal JS can. Just because it uses 20,000 characters to do a simple if statement doesn't mean your eval is 'safe'.

</comment></comment></comment><comment><USER14> So we restrict it to a subset that you can't figure out how to exploit? How reassuring.

<comment><USER15> Haha... exactly. Seems questionable to me.

</comment></comment><comment><USER16> This idea is neat, and the article does a good job of highlighting some of the potential evil and potential good of eval. However, as many other commenters have pointed out, it's far from a complete or trustable solution--and even if it's good enough _for now_ , it may not be good enough for the JS of tomorrow (this language iterates bloody _fast_ ).

Far better would be a capability-based sandbox API in the browser (like the Node.JS one: [https://nodejs.org/api/vm.html#vm_vm_createcontext_sandbox_o...](https://nodejs.org/api/vm.html#vm_vm_createcontext_sandbox_options)) that also supports filters like "stack depth" to limit infinite recursion, and/or some sort of opcount to limit other nonterminating functions. Combine those two things, and you have at least a way to secure arbitrary code you want to eval.

I think that most people with a real/non-insane need for such a service would be willing to pay a fair amount of performance (e.g. introducing an Erlang- esque reduction count idea to code inside the sandbox) to get it working safely.

Mind you, even if that existed it'd be hard to use correctly; people would try to safe-eval code, fail, and open up over-promiscuous capabilities (just like redis: [http://antirez.com/news/118](http://antirez.com/news/118)), putting us back at square one. For many purposes, though, it would be a very interesting and powerful tool when wielded carefully.

</comment><comment><USER17> While fun, I do hope this is a joke, since as other comments have said, it's fairly straight-forward to make a DSL for the given problems that this could solve. Beyond that, this would never be safe from syntax mutations in new versions of ECMAScript and sadly would cause issues similar to the recent smoosh controversy (where a common library implemented `flatten` in a way that was incompatible with the new ES specification).

</comment><comment><USER18> Title should be:

> A Case for Safe Eval

The author's argument is that there is at least one valid use case for eval, not that it belongs in all web projects.

<comment><USER19> Also, "in JavaScript" can be appended to make clear that this is specific to that programming language.

<comment><USER20> "Using JavaScript's eval function to evaluate limited arithmetic expressions safely"

</comment></comment></comment><comment><USER21> At this point, why not just implement a restricted interpreter in JS with a simple language. As soon as you do anything non-trival you're going to want variables and function calls.

<comment><USER22> This is similar to what Tcl does for Safe Interpreters.

[https://www.tcl.tk/man/tcl8.6/TclCmd/safe.htm](https://www.tcl.tk/man/tcl8.6/TclCmd/safe.htm)

</comment></comment><comment><USER15> I see why it doesn't allow their example of "(() => 5)()"

But what is preventing me from doing "((a) => 5)(0)" since the regex only requires at least one non space char between parens...

Or any function call really?

<comment><USER23> `(a)` isn't allowed because letters aren't allowed, and you can't put a number in the argument location (e.g. `((1) => 2)(3)` doesn't parse as valid JS).

<comment><USER24> A commenter above offered

((/ __/ )=>5)(/ __/ )

<comment><USER24> HN formatting is messing this up. It should have two asterisks between each "//"

<comment><USER23> indent 2+ spaces for code-like formatting :)

      *plenty of asterisks*
      /**/

Also simplifies ascii art since it's mono-spaced:

            |\__/,|   (`\
          _.|o o  |_   ) )
      ---(((---(((</comment></comment></comment></comment></comment><comment>---

</comment><comment><USER25> Maybe the author of this could provide a web page that allows anybody to enter "safe" JavaScript.

Provide a $10 prize for setting a cookie to value xyz, or for calling function zyx().

Repeat until safe.. (Makes me think how bug bounties really are useful but not that useful for security).

<comment><USER3> Need to raise the bounty quite a lot to make white hat more attractive than black hat.

<comment><USER25> Yet lots of people do security CTF competitions ([https://ctftime.org/ctf- wtf/](https://ctftime.org/ctf-wtf/)) for free. Offer less instead!

</comment></comment></comment><comment><USER26> I agree that safe eval and safe JSON parsing should be higher class citizens in the JS world. Just curious, is this (one of the reasons) why companies like Salesforce introduce an alternate language such as VisualForce, to have more control over safety? It would be nice to not have to force users to learn a new language to enable dynamic runtime features. I feel that it's near impossible to outsmart all bad actors, but it would be nice to enable full user creativity by allowing access to an existing language.

</comment><comment><USER27> If you really wanted to do this you could avoid a whole bunch of badness by spawning a worker, clearing out all the timer and networking APIs and just evaluate the script there.

Infinite loops etc could still happen but they would not significantly effect your page and the worker gets killed when the user navigates.

As far as their regex goes I'm not sure it actually prevents the wonders of [] based programming.

<comment><USER27> Found it again — jsfuck.com does the translation automatically. I have not tested whether it's doable yet

</comment></comment><comment><USER28> Python has ast.literal_eval built into the standard library, which is a pure Python lexer/parser/evaluator for Python syntax. So you don't have to write your own lexer and parser and so on. It's somewhat slower though, being written in pure Python.

</comment><comment><USER18> Wouldn't doing `eval` in a service worker provide an even greater level of safety? Might even be enough to drop some of the character restrictions, if the use case was broader than the one here.

<comment><USER10> An answer on StackOverflow [https://stackoverflow.com/a/26488003](https://stackoverflow.com/a/26488003) claims that web workers count as same origin, but you can totally solve this use case with <iframe sandbox>. (And other answers say that sites like JSFiddle do exactly this.)

There's an example of using this for untrusted eval in the linked HTML5Rocks post: [https://www.html5rocks.com/en/tutorials/security/sandboxed-i...](https://www.html5rocks.com/en/tutorials/security/sandboxed- iframes/) The amount of code involved is pretty minimal and doesn't involve opaque regexes, so something like that is probably the actual best option for someone who wants safe eval.

That StackOverflow user also has their own library that does this using a sandboxed iframe _and_ a web worker: [https://github.com/asvd/jailed](https://github.com/asvd/jailed)</comment></comment>


How experts stay safe at the Black Hat security conference - <AUTHOR> http://www.usatoday.com/story/tech/2015/08/03/black-hat-defcon-computer-security/31016809/ <comment><USER2> I was at a security consultancy that sent a lot of people (~30) to Defcon and quite a few to BlackHat as well. I remember the pre-conference security briefing.

No company laptops on the trip at all, regardless of hard drive encryption, VPN (both of which were compulsory for off-site laptop use). Company phones had to have a long unlock password, enforced centrally. No 2G - all been hacked, no 4G, hacked, only 3G, but no client details over 3G. They recommended a burner SIM, and to not use the company provided SIM at all.

<comment><USER3> Don't suppose you have any more details on 4G being hacked? My understanding is that the authentication phase is actually better/more secure than 3G.

<comment><USER4> I always thought that hacking 4G (and/or 3G) was done by jamming the signal and thus forcing the phone to switch to older, already cracked protocol.

<comment><USER5> yes, that's how its done

<comment><USER6> So what makes 3G more resilient to downgrades than 4G?

<comment><USER7> I understand that 4G devices don't always use the 4G network for voice, they may either use 2 radios, or drop the 4G connection. The 4G network is used for data, and a 2G network for voice/SMS.

Eventually they will all start sending voice over the data link, but it isn't guaranteed.

<comment><USER3> As far as I know, none of the UK macro operators support Voice Over LTE yet, so yes, if you receive a phone call on 4G you get a paging message telling you to fall back to 2/3G circuit switched and answer the damn thing.

I'm assuming this is my stock S5 won't let me choose 4G only (calls become impossible), where as I can lock it to _just_ 3G.

I don't feel this fully addresses the original statement of "no 4G, hacked", though. If the downgrade-to-2G attack is the worry then 3G & 4G should be perfectly fine.

edit: grammar: supported->support.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Nice read. I could envision a Hollywood movie on this premise: Denzel Washington, our protagonist is the country's leading hacker / security expert, invited to give a talk. Only that an unknown Russian will crack him handily, stealing some government secrets. Then the movie would quickly deteriorate into gas explosions and "hacking tools" written in VB.NET.

<comment><USER9> Flip the plot and make it a heist movie.

Movie opens with Chinese cyber-ops lab, head honcho brings in McGuffin device, plugs it in. Cut to scenes in US of machines being compromised, data, leaking, cars stopping, TV broadcasts being controlled.

Our protagonist is shown, recognising the attack and taking action: she unplugs her computer and goes for a run past stranded trucks and cars.

Titles.

A few weeks later, media is still talking about the biggest attack on US computers. CIA meeting discusses that the Chinese head of cyber-ops is known to be attending Black Hat with the McGuffin (it never leaves him). CIA has a team on trying to hack him, but two deepthroats in the room talk to each other about their suspicion that one of the CIA team is a double-agent.

One Deep Troat, a high level agent from black-ops three letter agency approaches our protagonist, an independent pentester, a hippy wunderkind living in an RV in New Mexico. They ask her to take her team to Vegas, make the hack and identify the CIA mole.

They plan the hack, involving lots of physical as well as digital subterfuge. Then they go to Vegas, have scenes of being out of their element, then the hack begins and they mostly raise their game. The CIA team detects them, destroying their hopes of finding the mole, so they focus on the McGuffin.

At the last minute it turns out the Wunderkind's best friend on her team has also been turned as a spy, and gives her identity to the CIA mole and Chinese authorities. Wunderkind has to finish the hack alone, while being hunted down by both agents.

She does so, even managing to tag her former friend so he can be picked up by the authorities, as the Chinese leave him out to dry when they retreat. Movie ends with Wunderkind receiving an offer from black-ops to work for shadow 3-letter agency full time. She returns to her RV and shreds the offer letter.

<comment><USER10> Black Hat 2?

[https://www.youtube.com/watch?v=Qn2g9qGbH_k](https://www.youtube.com/watch?v=Qn2g9qGbH_k)

[ed: As usual for Hollywood movies of late, the trailer is considerably better than the actual movie]

<comment><USER9> Thanks, I'd not seen that :)

I was following 'Hollywood Plotting Cliches', seems the screenwriters of that movie have the same book.

I like my heist movies with fewer gunshots though, even the trailer left me cold.

</comment></comment></comment></comment><comment><USER3> "He counsels staff and clients to keep their credit cards in specially shielded envelopes to or stack them one on top of the other so the signals are jumbled up."

Slightly terrifying advice. A few years ago Kris Padgett (iirc) demonstrated that nearly all RFID "blocking" wallets were useless. That and they employ some immense collision detection -if you can throw a binbag full of chips past a reader and still manage to scan them all, I find it impossible to believe 2 cards stacked does _anything_ to help.

<comment><USER10> Why not just buy pre-paid VISA cards [ed: and even if they do -- the damage will be limited] ? AFAIK they don't have RFID? I'd be more worried about my passport (if it had RFID).

<comment><USER11> As soon as my RFID passport arrived, it went into the microwave for a few seconds. No smoke, no discoloration - just a slightly raised outline.

And _no more_ RFID.

<comment><USER10> But is it then, technically, still a valid passport?

<comment><USER11> Valid enough for human validation! (Although, I think it's technically illegal to deface a passport. But, at the same time, it's not technically 'defaced'...)

Edit: As a frequent (if reluctant) traveler, I've yet to encounter a necessity for RFID at passport control. (I simply avoid that particular queue.)

I've been stopped twice for not being obedient: once because I refused to step into a mm-wave scanner (after the controller refused to send me back through the metal detector after I removed my belt...), and another time for not staring into the hypnotic blinkenlights that were swirling around the cameras above everyone's heads in the queuing area.

<comment><USER12> Can you elaborate on the 'hypnotic' lights? I've never seen or heard of this.

<comment><USER13> Were there four lights? Or five?

<comment><USER11> I really can't recall. I wasn't looking up!

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> I think you are mostly safe at Defcon/Blackhat. I think you have to worry if you are a target for nation state / criminals (suspected of selling vulnerabilities at the con) then your room is probably going searched.

[https://twitter.com/thegrugq/status/367364810729472000](https://twitter.com/thegrugq/status/367364810729472000)

<comment><USER15> The victims seem to agree the search was sloppy because it was obvious, but I would argue the main value of searching your locked safe and leaving behind a mess is exactly in sending this signal, letting you know you're being watched. Over the years, this paranoia will add up, and some people do break down because of it.

<comment><USER16> If they were trying to intimidate they'd have taken his shoe. [http://www.telegraph.co.uk/news/11673700/Muslim- campaigner-Z...](http://www.telegraph.co.uk/news/11673700/Muslim-campaigner- Zionists-crept-into-my-home-and-stole-my-shoe.html)

<comment><USER12> Or worse, stacked them: [http://i.imgur.com/a7app8J.jpg](http://i.imgur.com/a7app8J.jpg)

</comment></comment></comment></comment><comment><USER17> I've never been to one of the US based conferences (mostly CCC). Has the attitude towards the NSA changed a lot in recent years? A while back it was more or less friendly banter and the meet the FED panel was fairly relaxed (from watching Defcon(?) videos). I remember they gave away mugs and joked about them being bugged (which to me felt like they probably were somehow :P).

<comment><USER18> In 2012 General Keith Alexander gave a keynote at DEF CON; basically a recruiting speech asking for white-hats to share with the government. Then, after Snowden, In 2013 Dark Tangent (DEF CON founder) asked feds to take a break. I believe he did last year as well.

</comment></comment><comment><USER19> Personally, I just stay home. I go to local BSides conferences (where a minimum wage worker can reasonably be expected to afford to attend without a premeditated effort to save up) and give talks there.

I don't think I'll ever attend Black Hat. I might attend DEFCON, unless the prices go up much higher. The interests of people who can afford tickets to BH USA are already well served by the security consultants they can afford to hire.

And if I ever do speak at DEFCON, it will be repeating a talk I already gave to the local Bsides event. Communty > Industry.

<comment><USER20> If you're in Europe, CCC[0] is cheap and worth going to. That said, attendance has apparently skyrocketed the last few years.

[0] [https://en.wikipedia.org/wiki/Chaos_Communication_Congress](https://en.wikipedia.org/wiki/Chaos_Communication_Congress)

<comment><USER21> was cheap, they bumped price this year considerably

<comment><USER20> €80 (2013) -> €100 (2014). I still think that's pretty cheap for a 4 day conference at such a quality venue.

<comment><USER21> and >300 this year

<comment><USER20> Source?

</comment></comment></comment></comment></comment></comment><comment><USER22> Leave your technology at home and actually _meet people_. That's the biggest benefit of not having your laptop and primary phone with you.

Granted, the crowds and general culture of the conference doesn't always support this, but to me it's the best part.

</comment><comment><USER23> I am planning on trying to go for defcon next year what should I prepare for, in terms of room, restaurants, and other attractions?

<comment><USER24> A lot of the paranoia is just that--paranoia. Still, there are a lot of people messing around on the wifi and some playing with cell stations, so some caution is justified.

If you're going on the company dime and thus have a rental car, the best thing to do is stay at a hotel somewhere else. I haven't gone since they changed venues, but I used to stay at a chain hotel on the other side of the Strip from the Rio. I'd use their hotel wifi but push all my communications over an ssh tunnel, which is what you should be doing anyway on ANY public wifi.

When I got to the conference, I tended to just put my phone in airplane mode and leave it like that. I'd bring a spare laptop and boot Linux off a USB stick so I could take notes; I sometimes turned on wifi but never signed in to anything online, just looked up wikipedia articles and such. You're probably not at such a great risk because security is a lot better these days (SSL and whatnot), but you'll pay more attention to the talks if you don't have your usual set of distractions available.

Go see the Strip, but after you've seen it once I've never felt much draw to go back. If you have a car, drive over and see Red Rock Canyon in the evening, it's just outside of town and very beautiful. Lots of good restaurants around, just pick what you're interested in. I had some pretty authentic and tasty Chinese food about a mile off the strip last time I went.

It's a lot of fun, relax and enjoy!

<comment><USER25> A geeky nearby attraction is the National Atomic Testing Museum.

[http://www.nationalatomictestingmuseum.org/](http://www.nationalatomictestingmuseum.org/)

<comment><USER24> How could I have forgotten this! Definitely go to the testing museum, it's about 1 block from the strip and is super cool.

</comment></comment></comment></comment><comment><USER26> While shenanigans do go on at Defcon and Blackhat most of these "no computers, no cell phone" precautions are overreactions.

<comment><USER27> People don't drop 0days at BlackHat, and if they want to do, they will do it during a briefing not in the lobby exploiting people's phones/laptops/smartcards.

</comment></comment><comment><USER5> this stuff's funny

except for paranoids - if you're not able to use your regular tools at blackhat by fear of being compromised, this means you don't trust your tools, go fix em - because if they're not safe at bh/defcon, they're safe nowhere.

in reality, even the wifi is pretty safe, LTE-only networking with VPN works out fine etc.

</comment><comment><USER28> I put on a condom before I even clicked the link.

<comment><USER29> I should have - clicking the link crashed my browser hard (chrome-stable in ubuntu/gnome-shell). Pretty sure it was just something in one of the 2000 ads and social media widgets on the USA Today page.

I haven't had chrome crash that hard since I switched back to the stable branch six months ago. The tab crashed first, but the whole Gnome Shell actually went unresponsive except for desktop switching. Apport was running wild and I had to kill it from the console to get X to start responding again.

</comment></comment><comment><USER30> Actually this sounds kind of fun sans the whole someone will read your credit/debit card from 5 feet away. Buy a laptop on craigslist for $100, re- format, get some throw away email accounts and see if you can go about your somewhat normal daily life on the 'Net without getting stomped as you connect across potentially hostile and un-trusted networks. The challenging part would be verifying you got through the conferences ok without any intrusions or someone sniffing your passwords.

<comment> at-fates-hands Better be checking the "wall of sheep" frequently then!

<comment><USER14> I tried to dump fake credentials / XSS - SQLI the wall of sheep 2 years ago but I couldn't get it to display any of my requests.

</comment></comment></comment><comment><USER31> Typo. I think that

        Having to protect a single laptop isn't that big a deal, Black said. "We get over 20,000 unauthorized probes on our system every minute," he said.

Should be (Black -> Blech)

        Having to protect a single laptop isn't that big a deal, Blech said. "We get over 20,000 unauthorized probes on our system every minute," he said.

</comment><comment><USER6> Who are the people saying this? (I've never heard of Proficio before, but apparently they have a sponsored nascar car.)

</comment><comment><AUTHOR> "And because it's an event that brings in high-level government and corporate staff, there's also plenty of data and networks to entice the nefarious.It's one-stop shopping, a place were every major security executive is gathered..." \---- I wonder who's got hacked in the past

<comment><USER32> Read old DefCon reports. In 2009, someone remotely read the RFID chips on government secure IDs.[1]

[1] [http://www.wired.com/2009/08/fed-rfid/](http://www.wired.com/2009/08/fed- rfid/)

<comment><AUTHOR> wow, that's crazy --- thanks for the share!

</comment></comment></comment><comment><USER33> Is it completely unreasonable/paranoid to not bring any electronics or credit cards when attending these kinds of conferences?

</comment><comment><USER34> > That means "the rules are a little different," said Stan Black, chief > security officer for Citrix in Fort Lauderdale, Fla. For example, he's > bringing his schedule printed out on a piece of paper so he doesn't have to > turn on his cell phone to check it.

> "And they're all staying in the same hotel," said Steve McGregory, director > of threat and application intelligence for Ixia, a security firm in > Calabasas, Calif..

> Jon Miller, vice president of the security firm Cylance in Irvine, Calif., > doesn't see the hacking at Black Hat as malicious so much as simply > intellectually curious. But he still turns off Wi-Fi and Bluetooth on his > phone and only logs on to the Internet from his hotel room using a virtual > private network.

Ok I get it, it's a hacker's con, with hackers hacking hackers. If you don't want your phone hacked, don't bring it to Blackhat. "It's to be expected", right?

But isn't also a little bit insane?

What about the people working there? Hotel staff, catering, nearby bars, shops, etc. Do they get debriefed about security countermeasures like this? Or are they left to their own devices? (or should I say "0wned devices")

Do the hotels use computers? Do they get help protecting their systems from damage? How do they manage to get their systems back into a safe and stable state for the rest of the year for when, you know, the place isn't swarming with people for whom "the rules are a little different".

Sounds to me the waiting staff will be the ones with the least protected phones, attracting the "intellectually curious". I'm just thinking of these additional scripts available, not the exploits, but the ones designed to slurp data after a way in has been found. They are targeted at the common types of accounts/usage, facebook and gmail, automated email digging, further escalation to ID theft, etc. Most security researchers/consultants know of these tools but they never _really_ get to use them in their day job, because usually you don't have to follow an exploit all the way through to begin protecting your client from it. But now, _they 're on Blackhat!_ And the rules are a little different! Finally!

And even after all the hackers leave, the exploit's still in your phone.

Perhaps I'm being a bit hyperbolic here, but grant that it is a pretty crazy situation and I'm actually curious, how do the local people working there deal with this?

Imagine going to a gun convention and being advised to better prepare by wearing a bulletproof vest, because "the rules are a little different" there :)

</comment><comment><USER35> Do break-ins increase during security conferences because hackers realize the watchmen are busy? Or do they go down during these conferences because the people breaking in are also the people at the conferences?

<comment><USER4> You put a bunch of people who do pwning for fun and/or a living in one room; it's not surprising if some will start pwning each other to show off or just for teh lulz.</comment></comment>


My Bathroom Mirror Is Smarter Than Yours - <AUTHOR> https://medium.com/@maxbraun/my-bathroom-mirror-is-smarter-than-yours-94b21c6671ba#.qalaketfq <comment><USER2> Niiiice. How did you manage to get this to look this thin?!

<comment><AUTHOR> That's exactly what I focused on. :) I picked a very thin display panel and then hid it between the door and the glass. I'll probably post some more behind-the-scenes pictures of that.</comment></comment>


How Nature Manages Its Information - <AUTHOR> http://nautil.us/issue/48/chaos/nature-the-it-wizard-rp <comment><USER2> Well, information entropy is isomorphic to thermodynamic entropy. To waste information capacity is to emit energy as waste-heat which could have done useful work.

Of course Nature "tries" to pack in as much meaningful signal as possible!

</comment><comment><USER3> _" DNA stores information at a density per unit volume exceeding any other known medium, from hard disks to quantum holography. It's so dense that all the world's digital data could be stored in a dot of DNA the weight of eight paper clips"_

What???

<comment><USER4> Well ... it seems you might be right. Another estimation states:

"Capable of storing 215 petabytes (215 million gigabytes) in a single gram of DNA, the system could, in principle, store every bit of datum ever recorded by humans in a container about the size and weight of a couple of pickup trucks."

[http://www.sciencemag.org/news/2017/03/dna-could-store- all-w...](http://www.sciencemag.org/news/2017/03/dna-could-store-all-worlds- data-one-room)

Not sure what they base it on though. Perhaps we'll have to do a more proper calculation ourselves ...

<comment><USER4> Perhaps they include the weight of stuff like histones [1], which DNA is wound up upon in order not to get entangled. That could add some considerable weight. Also there are various epigenetic modifications on top of that, further adding weight, in DNA in its biological form.

[1] [https://en.wikipedia.org/wiki/Histone](https://en.wikipedia.org/wiki/Histone)

</comment></comment></comment><comment><USER4> For a recent book / set of papers on the topic of understanding biological information, I can recommend having a look at the BINP book: [http://www.binp.org](http://www.binp.org) (Biological Information, New Perspectives).

It is a collection of papers from a symposium on the topic at Cornell University.

</comment><comment><USER4> I maintain that it takes utter foolishness to not acknowledge the screaming intelligent design behind nature. Seldom does it get clearer than when we as information systems designers study the information systems in nature, and find basically all our "inventions" all there already, in an uber-elegant, uber-effective, uber-smart version.

Heck, even the TCP/IP protocol has its counterpart with the addresstags (post translational modifications), for sorting in the biological router called "golgi apparatus" [1].

We never observed a process creating these structures that doesn't start from already existing such structures, and it's not like we see these structures popping up spontaneously everywhere in the universe. No, we didn't find them elsewhere than on this very planet, out of the hundreds we can observe.

The combination of such ingenuity on every level -- physical and abstract -- with such an astonishing beauty and such purposefullness, also on every level, makes me cringe when the cred for all of this is given to this unobserved idea of evolution _.

_ No, I'm not talking about the changes we do observe in nature today which also go under this term, but on the origin of these solutions and structures.

[1] [https://en.wikipedia.org/wiki/Golgi_apparatus](https://en.wikipedia.org/wiki/Golgi_apparatus)

<comment><USER5> Or maybe you've got the causality backwards: We humans are the _results_ of a designer-less stochastic evolution, and we internalize its operating principles, which come back out again when we look for "intelligence".

In other words, it's the anthropic principle again: If the universe operated differently, and different patterns were evolved and led to us, then we would consider different patterns to look intelligent.

<comment><USER4> ... and then trust that this designer- and intention-less stochastic, random, evolution brought us brains that tell us the ultimate truth?

Given the heavy biases of the anthropic principle, odds don't look good (... when we can't take back on some intentionality towards anything, behind anything).

<comment><USER6> Who is talking about ultimate truths? Science is about doing observations and trying to figure out what models explain the observations best, not finding some mystical ultimate truth.</comment></comment></comment></comment>


Brawling Bohemians - <AUTHOR> https://www.instapainting.com/blog/artists/2014/08/14/brawling-bohemians/

<comment><USER2> It's cool to see startups working in cultural areas... [http://www.thebolditalic.com/articles/5512-can-sfs- highbrow-...](http://www.thebolditalic.com/articles/5512-can-sfs-highbrow- arts-survive-without-tech-money)</comment>


Security experts call for government action against cyber threats - <AUTHOR> http://www.reuters.com/article/2014/08/09/us-cybersecurity-hackers-policy-idUSKBN0G90MC20140809

<comment><USER2> Maybe when the government will stop acting as the _enemy_ of security, then we can ask them for help. Right now the gov only seems interested in funding offensive capabilities, so they aren't only useless, but harmful and sabotaging any serious security discussion.</comment>


Developing a Backbone.js Edge - <AUTHOR> http://bleedingedgepress.com/our-books/backbone-js/

<comment><AUTHOR> This was a fun book to be a part of writing, due to the unique way how 5 of us (including some core Backbone.js contributors) got together for a "book sprint" and collaborated on both the sample project, and writing the book itself, over a short period of time.

* $5 off from Gumroad: <https://gumroad.com/l/mtan/$5off>

* <http://techbus.safaribooksonline.com/9781939902016>

* Kindle: [http://www.amazon.com/Developing-a-Backbone-js-Edge-ebook/dp...](http://www.amazon.com/Developing-a-Backbone-js-Edge-ebook/dp/B00CBP7N3O/?ie=UTF8&tag=backbone05-20)

<comment><USER2> It looks like an interesting book, and the price is nice, but it's a hard sell with so little information on the contents; even just a table of contents would be very helpful...

<comment><AUTHOR> There's a ToC here: <http://techbus.safaribooksonline.com/9781939902016>

and the associated GitHub project is online here: <https://github.com/backstopmedia/hubbub/>

<comment><USER2> Ah, I hadn't check the safari link, much better thanks!</comment></comment></comment></comment>


Plancast Is Foursquare... For The Future - <AUTHOR> http://www.techcrunch.com/2009/11/30/plancast/

<comment><USER2> Somebody asked recently what I meant when I said lots of startups make things for technically-inclined twenty-something males. I meant that lots of startups make things like this. If your first thought after "I kind of want to go out to dinner on Thursday." is "I wonder if a site exists that can broadcast this to my social networks yet?", you are solidly in the demographic most B2C startups seem to care about.

There are also people who, when they think "I want to go out to dinner on Thursday.", follow it up with "Naturally, I will bring my husband and children." These people do _not_ have an endless stream of Silicon Valley companies trying to satisfy their every whim. That is a pity, or opportunity, depending on how you look at it.

<comment><USER3> Of course not everyone is going to want to broadcast every move they are going to make, but that isn't half of what Plancast can offer you.

For example, a couple weeks ago I learned that Marcy Playground had released a new CD and was touring. I was bumbed I missed their show simply because I didn't know about it.

Now, if Marcy Playground was on Plancast I could've just subscribed to their upcoming feed and easily have seen where they were going to be and when they were going to be there.

Now, how awesome would it be if all your favorite bands were on Plancast? You could create a feed of just bands you liked and have their tour schedules come to you.

But let's not stop at bands, what about your favorite clubs or restaurants? You could create a custom upcoming feed of only the places you want to go.

Give Plancast a chance and you might just grow to love it.

<comment><USER4> I use last.fm to "scrobble" all of the music I listen to. It knows what artists I like, any similar artists to those, and most tour dates. There is even an "events" page that lists all of these shows, filterable by geo and artists that I might actually like. This has solved all of my "didn't know they were on tour" problems.

<comment><USER3> Touche.

</comment></comment></comment></comment><comment><USER5> Plancast needs support for uncertainty. I might be going to this place sometime next week but I'm not sure yet. Perhaps if a friend also says they're going then I'll be more certain.

Similar to upcoming.org's interested vs attending.

</comment><comment><USER6> More feedback:

\- Really lovely site. Lots of great touches. I typed that I will be going to Bar Wotever (actually the name of a night, not a place) tonight and it figured out where the venue is automatically.

\- Could the little red bars next to each time window (today, next week etc.) give some idea of futureness? e.g. green for today, yellow for this week, red for further away in time.

\- Can I hide a friend's plan?

\- If I'm on the Discover Friends page, the data does not refresh when I switch between the Twitter/Facebook/Email tags. To do that, I must refresh the whole page in my browser.

</comment><comment><USER7> whoa. that signup was extremely frictionless with both twitter and facebook. i already found friends and plans i share with them without doing anything really. i'm impressed.

<comment><USER8> You found the form with 12 fields to fill in to be frictionless?

<comment><USER9> Even with pre-population, I would have to give them an e-mail address and create a new password. Sorry, I'm not joining until my friends make me. And given that I'm just barely still in my 20s, not bloody likely.

</comment></comment></comment><comment><USER10> Wait, wait... A few hours ago I submitted a link about Sponty and how they can compete with Foursquare. (<http://news.ycombinator.com/item?id=969221>).

It's kind funny how the techcrunch article gets instantly lots of votes, and link to random blogger gets ignored.

Anyway, Sponty also offers a social calendar, where you can broadcast your intentions, and also have feeds for different events.

<comment><USER5> There's a large glut of "this new service is like foursquare" submissions over the past few days.

</comment></comment><comment><USER6> Very impressed by the date handling. I entered Thursday to Saturday and it figured out what I meant.

However, I can't make it understand ranges further in the future. For example, I'm going to All Tomorrow's Parties from 11th Dec to 13th Dec and I can't make Plancast understand that.

<comment><USER3> Funny story, turns out I forgot to commit our latest date_parser before Thanksgiving break and then accidentally over-wrote it with the one from the repository because I thought it would be the most up to date.

So, the current date parser has some bugs that were caught and fixed and then lost. The good news is I have re-fixed most of all those bugs and I just tested "11th Dec to 13th Dec" and it parsed it correctly. The new parser should be pushed live in a day or so.

<comment><USER6> Cool. Thanks a lot.

</comment></comment></comment><comment><USER11> I really like the idea, but the feature mentioned at the end of the post to allow limiting plans to certain friends is a must have - many of my plans I won't want the whole world to know about.

<comment><USER3> We have been going back and forth on how to do this, the problem is we really don't want to clutter the simpleness of "what, when, where" with lots of other dialog boxes, so we are trying to find the best way to integrate advanced functionality like privacy and still remain simple.

<comment><USER12> very nicely done, we tried something similar some time ago but i never finished it :-) good luck

</comment></comment></comment><comment><USER13> This reminds me of dopplir, in essence but much more localised. I'll never use this myself but I can see this doing well.

</comment><comment><USER14> definitely. Once they get gcal integration going, that will just take it to the next step.

<comment><USER3> While we don't have full integration yet, every page does offer an iCal feed so you can at least subscribe to your Plancast feed in Gcal to get a one-way stream going.

</comment></comment><comment><USER15> I've been a "beta" tester for this - it's pretty useful!

Congrats Mark!

</comment><comment><USER16> It's an excellent idea, and in Trumps voice: This is going to be huge.

</comment><comment><USER17> So it's a 43Things reboot?

</comment><comment><USER18> really cool -- hope they open up an api

<comment><USER3> We're working on it, judging by the amount of emails we're getting about an API, I'm thinking we're going to drop all our other upcoming features to get the API up and running for everyone.

The only thing that stands in our way are all the bug reports we've gotten also.</comment></comment>


Show HN: Cent – Earn ETH by answering questions - <AUTHOR> Hey HN!
Today my cofounder Max and I are launching the beta version of Cent — a question-and-answer service that allows answerers to make money, and curious individuals with a need for knowledge a way to get quick answers on anything that comes to mind.
When a user asks a question on Cent, they place an ETH bounty on the question as well. The higher the bounty, the more the network is incentivized to answer you clearly and concisely, providing you more valuable information for your inquiry due to the additional monetary incentive.
Users then vote on which answer(s) they determine to be deserving of the bounty and then the funds are distributed to the users who wrote the best answers.
Our eventual goal is to create several mechanisms for people to earn money remotely, but this is our first major feature, and we wanted to gather as many useful comments and feedback as possible.
Would love to hear any feedback from you all! Our site is https://cent.co and the direct link to the beta is https://beta.cent.co <comment><USER2> how do you stop people gaming the system by voting their own answer to the top?

<comment><AUTHOR> Our general strategy is to rely on the community for most of the moderation. Right now, users have simple, equal voting privileges on every question/answer. In the future, we're going to incorporate per-channel reputation that is accumulated through the bounty earning process. So each user would start with 1 reputation, and as they answer questions and have their answer voted on by others, they accumulate reputation. This reputation in turn translates into greater voting power on other answers within the channel. Certainly not a silver bullet, but that's where we'll start.</comment></comment>


Ask HN: What streetsmarts have you learnt? - <AUTHOR> Hey guys,
I was listening to a podcast that made me realize how I'm surrounded by book smart people and am mostly book smart myself. I'm sure this describes a lot of people here on HN.
As an aspiring entrepreneur I'm striving to become more street smart and to be able to persuade people, not get screwed over, negotiate well, create and see opportunities, be able to make things happen that other people can't etc etc.
What stories do people have of experiences, lessons, things they have seen or read that they feel have taught them some more street smarts? Would love to hear them.
The irony of looking for books on how to become more street smart is not lost on me btw.
Thanks! <comment><USER2> The most limited resource you have is not money, it is time. One Year of your life is a HUGE piece of your life. If life expectancy is around 70, and you don't really get full control of your life until you're around 20, then you have 50 years of life that you can direct as you will. One year is a whopping 2% of that. So wasting even a year being stuck in a crappy job or otherwise undesirable situation is a bad bad deal, even if you're getting paid big money. You need to be doing whatever it is that you really want to be doing, whatever it is that you're innately wired for and drawn to ... and you need to be doing it _right now_. If not, then you need to be _on a road that will get you there_ , and that road needs to have a realistic chance of getting you there _very soon_. Because remember, 50 years is the _optimistic_ number. You might only have 5, or 1. Stop chasing the dollar or whatever else leads you astray, and start doing whatever it is you are "meant" to be doing. ASAP.

<comment><USER3> Just wanted to say that I just printed your comment to stick it on my wall.

Thanks for the lucid formulation. Even though I have been thinking like this all along, it is nice to have a succinct reminder.

</comment></comment><comment><USER4> Bring your boss options, not problems. Your boss has plenty of problems. Don't add to the collection. When you bring options, you also get the chance to influence the direction of the company. One problem at a time.

<comment><USER5> It's taken me a long time to learn this one. This will likely be the best advice in the entire thread.

<comment><USER6> That puzzles me because it's pretty conventional, "bookish" advice. It's the sort of advice you're likely to hear in any business-related course, book or blog. Try googling ' "your boss" options OR solutions "not problems" '.

I'm not saying that it's bad advice, but it's only a start, and it can fail you in many, many ways.

 _Edit_ : I realize my comment wasn't very constructive so here are some examples.

1) your girlfriend has gained weight. Instead of just telling her that straight out -- which is usually a bad idea, of course -- some people think it's a good idea to offer her "options", like offering to eat healthier with her or doing exercise together. But this won't fool your girlfriend. You're still telling her that she's fat and she very likely won't be happy about it.

Often your boss won't be happy to hear you pointing out problems no matter how good your solutions are.

Also, when you point out problems you might make other people or teams look bad, _especially_ if your solutions are good.

2) Your boss might be a "sociopath" (not literally) and will use your "options" against you.

[http://www.ribbonfarm.com/2009/11/11/the-gervais- principle-i...](http://www.ribbonfarm.com/2009/11/11/the-gervais-principle-ii- posturetalk-powertalk-babytalk-and-gametalk/)

<comment><USER7> The Gervais Principle is an awesome read, and I might even be convinced that it applies to a majority of workplaces, but that whole dynamic is one thing that people who work at startups are actively avoiding. I'm not saying it doesn't happen in startups, but it doesn't happen in successful startups (at least until >50 employees or so).

Also, fwiw, I wouldn't classify the Gervais Principle as street smarts. It's more like a parallel "bureaucracy smarts" that only makes sense in an artifically controlled environment like a large company. Whereas true street smarts are the kinds of things that would serve a street hustler just as well as an entrepreneur because they are applicable to all uncontrolled human interactions.

<comment><USER6> You make two very good points. I basically agree with everything you say above. I just have to point out that my comment wasn't intended to be an example of "street smarts" itself, but rather challenge that the grandparent post was so.

<comment><USER7> yeah I sorta got that but hijacked the response with my own agenda, hence the 'fwiw' ;)

</comment></comment></comment></comment></comment></comment><comment><USER8> Track record, track record, track record, track record. Look at the track record. Track records don't lie. Track record, track record, track record.

Someone fired from all their jobs is probably going to be a menace later in some form or fashion.

Someone who ended all their relationships on bad terms is going to end on bad terms with you.

Strong starters/non-finishers are going to start strong but likely won't be able to close it out without extra help later... which you might be oblivious to, because they'd started so strongly.

Track records don't lie. Unless you're _really_ good at spotting diamonds in the rough, don't grab someone with a bad track record for an important role in your business and life. I've learned this one the hard way too many times. I still get tempted with, "Wow, this guy/girl is so amazing, the problem must've been the other people..."

I'm trying to not do that any more. Once? Quite possibly a fluke. Twice? Maybe... Three times? That's a track record. Also, people will always say they've changed. It's probably a bad idea to be the first person to test out whether it's real or not.

<comment><USER9> Great advice. This is why it's VERY IMPORTANT to actually call references if you're considering hiring someone (or co-founding with someone, I suppose.)

<sidetracking into hiring lessons-learned...>

If you're nervous about calling, just remember that IF the person is great, their references will be falling all over themselves to tell you so. They'll be happy to talk to you. (In small companies, big companies may be HR stonewalling...) You're not bothering them, you're giving them an opportunity to tell you about this GREAT person and why you'd be insane not to hire them.

The clues are often found in the pauses, and what's unsaid. People don't like saying bad things about other people, so don't listen for that so much as cautious answers...

Eg.

"Would you hire them again?"

a) _pause_ Uh, yeah, I'm sure we would.

versus

b) In a heartbeat. We would absolutely hire them again. I'm hoping we can someday when our department gets more funding.

Lastly, a trick when you don't reach someone on a reference call. Say who you are, and ask that they call you back _if the person was incredible_

That way they can send you a message without saying anything bad directly (and this happens...)

</random hiring lessons-learned>

</comment></comment><comment><USER10> I usually write full posts on this sort of thing, so I'll just pick one very simple (albeit very important) lesson I've learned the hard way:

 _You haven't made money until it's in the bank._

<comment><USER6> I also learned this the hard way.

I was still in high-school and it was one of my first programming gigs. Got screwed for about U$250, a small fortune for me at that time (IIRC about 3 times the monthly minimum wage in my country).

In a way it was good to have that experience early: it seems that most people don't learn that lesson unless they learn it the hard way.

Then I learned the importance of having written contracts for everything, and then later I learned that contracts can't solve the problem, only mitigate it. You have to select your clients, bill often, etc. But you have do it diplomatically, you can never suggest to your client that you think he'll possibly screw you.

<comment><USER11> Got screwed for about 10x that in high school for one of my first programming gigs and about 100x that during university.

The worst part was in the latter situation I was really expecting to be screwed over but the expected value of the situation still made it worthwhile.

Getting paid on time is surprisingly difficult.

</comment></comment></comment><comment><USER12> Yesterday I was told a story about a successful man who was asked "how did you become successful?".

"Two words", he replied. "Right decisions".

"So, how do you make the right decisions?"

"One word: experience".

"OK, so how do you get experience?"

"Two words", the man replied: "wrong decisions".

Yeah, I know. Pretty corny. :)

<comment><USER13> This is an old saw! The way he delivered it dates back to, apparently, a kind of wandering Indian sufi-style legend.

</comment></comment><comment><USER14> _Eighty percent of success is showing up._ -Woody Allen

Punctuality has paid off well for me. Seriously, show up to work on time everyday and make everyone look bad in comparison.

Customer service has also been a very valuable experience, dealing with a whole range of people. Learning the art has given me the confidence to interact with _anyone_ , from executive to teenager, co-worker to police officer. Persuading isn't really my forte, but my bullshit detector is well honed.

My advice is get a job in a fast paced but low risk service environment that serves a range of people, the classic example is waiting tables. Master this and then use what you've learned.

<comment><USER15> IMHO, making everyone else look bad is about the worst thing you could ever do. It's highly unlikely that your manager will carry more weight in 10 (or even 2) years than everyone else you've ever worked with. Beyond that, your coworkers are a lot more likely to be your friends than your manager.

Basically, if you want to look good, do really great work and bring as many of your coworkers (and hopefully friends) into the fold as possible. When you're willing to share successes, you end up having a lot more of them, and credit will find its way to you.

<comment><USER14> Good point.

</comment></comment></comment><comment><USER2> This is from Jerry Weinberg, and also directly from my own experience. When you're paid to help someone accomplish a goal (whether as employee or consultant), you can only help in the areas where _they are giving you permission to help._ You may see some area where the company is misguided, and you may indeed have the knowledge or skill to help that area tremendously. But if they are not giving you permission to help that area, then you will only hurt yourself and the company by trying to "force" your help in that area. Stick to areas where they've given you permission, and learn to let the rest roll off your back like water off a duck. Over time, that may even gain you opportunities to help in other areas as well.

<comment><USER16> ...and, perhaps, over time, you can learn more about about getting invitations into new areas.

<comment><USER2> Jerry, is that really you? Your books have taught me so much I feel like you're an old friend. Yes, learning to get those invitations is going "meta" in a very good way. I'll take any tips you have.

</comment></comment></comment><comment><USER17> I really don't like the word "street smarts". Mostly because I am a book smart person. I've heard the same refrain self-proclaimed over and over again since high school "I might not get good grades, but at least I have street smarts".

Street smarts is really just a euphimism for doing bad academically. Now I do acknowledge that that there are a lot of important skills such as knowing how to sell, talk to people, make a pitch, get along,...but I would call that "social skills" or "social smarts"...not "street smarts"

Street smarts for me is literally knowing how to handle the streets...like a drug-dealer would...

<comment><USER18> Have seen this related line before:

Whenever someone says "I'm not book smart, I'm street smart", all I hear is "I'm not real smart, I'm imaginary smart."

<comment><USER7> Well, anytime anyone proclaims themselves smart, they are, at best, insecure about their intelligence.

Declaring yourself street smart is especially ironic since an actual street smart person would be looking to conceal their true intelligence.

</comment></comment></comment><comment><USER19> I have two things:

1\. _Just ask._ Seriously. There is so much that people want but don't get simply because they don't ask and assume the person will reply negatively anyway. Asking doesn't cost anything.

2\. _if you can figure something out, say you can already do it_. Obviously, you need to know your abilities here. But if someone asks a quote to do something in Tech X, and you think you might but haven't done anything with it...just say yes. People like confident people. and I'm sure you like new well-paying, interesting projects. (The caveat here is that you need to know what to say yes to.)

</comment><comment><USER2> Look at people's actions, not their words, and it becomes pretty obvious what they're working towards. Some people and companies have _incredible_ smokescreens. The most powerful smokescreens usually have to do with claims of morality, often tied to religion. The best of these smokescreens will fool almost everyone around. But if you look at actions and ignore words, you will be able to see right through such smokescreens, giving you significant insight that will help you in your situation.

</comment><comment><USER20> if you want to get people to buy into your idea, you often have to convince them that the idea was their own.

</comment><comment><USER21> I read something once that said you should do as many deals as possible.

In theory, whenever you do a deal (a good deal), you are getting something you want and so is the other party. So the more deals you do, the more progress you are making towards things that you want and hopefully only giving up things you are happy to give up.

I have to say I haven't done as many deals as I would like.

Part of doing deals seems to be having the imagination and experience to think about what is possible simply as habit, rather than just accepting the standard way that people do things by default. It's a hard habit to learn.

<comment><USER22> The red paper clip guy would seem to support this idea <http://en.wikipedia.org/wiki/One_red_paperclip>

</comment></comment><comment><USER23> Always look straight ahead when at the urinal.

</comment><comment><USER24> Overt initial intimidation is usually an attempt to mask a weakness or fundamental flaw ( _Thanks Dad!_ ).

This lesson has applied equally well to middle-school brawls, sports competitions, college professors, and litigious organizations.

</comment><comment><USER25> On crafting a good personal character there are two words: _convincingness_ and _credibility_. In any situation, you must always be convincing in what you do and say, and in a way that puts you in a good light without undermining your credibility.

This doesn't just mean "don't lie" or "don't get caught lying." It means that whatever courses of action you choose to take, you have to make sure that they are convincing and congruent with the environment. A magician is very convincing.

Things aren't always about facts but about emotions, what people _see_ , or how things appear, and about the people you surround yourself with -- the people others will see, then proceed to judge you by -- and how you handle yourself in budding relationships. Don't be afraid to accept favors and give favors without the presumption of your favor being returned. Franklin has said something on this to the effect of "ask to borrow people's books, even though you don't intend on reading it."

<comment><USER24> So true.

When someone new moved into the neighborhood, my Dad used to always go over and attempt to borrow a simple hand tool.

Keep in mind, (at that point) my father had been a mechanic in the Marines, a butcher and chef for over 20 years, and a serious cabinet-maker for over a decade. He already had every tool he needed.

His purpose was to "ask a favor" to simply start-up a conversation and a relationship. It's amazing what you can establish by simply asking a stranger for "a small favor".

</comment></comment><comment><USER26> reevaluate your situation often to make sure that you are getting paid per your value / not per the hour or age or need. It's important to make sure that you know your value.

<comment><USER27> I would add that you need to get paid in relation to the value you are creating for who is paying and less about your own perceived value of the work - which is usually based on totally different metrics to that of the client.

</comment></comment><comment><USER28> The artificial dichotomy of "book smarts" vs. "street smarts" is a poisonous one.

<comment><USER14> You could say "education" vs. "experience". I've seen company trained managers implode in tears on a sales floor, first week on the job.

</comment></comment><comment><USER29> Very little exists within a vacuum, whenever you make an important choice you're choosing a philosophical position. Always understand the angle of the factions you align yourself with, pick accordingly.

Things are rarely so cut and dried nowadays that you can easily understand what factions you're aligning yourself with so careful analysis is called for. Who do you work for? What do they do? Why do they do it this way? What are their dependencies, what is the ecosystem that each of these dependencies links into, and so on, and so forth.

Also, good way to analyse something from a competitive perspective too, weaknesses become clear. Everything has them, it's just a question of what's important to you.

</comment><comment><USER30> I hope this comment is taken the right way. I don't want to boast, but I have to say some things which will sound like bragging (even though it isn't) in order explain my 'ness' =]. Furthermore, a lot of what I say may be controversial to some and won't be appreciated. Also, I can't recommend you do anything I do, because even though it works for me, it will most likely have unintended consequences for you.

I use my street smarts every day. I may say the same thing to ten people ten different ways- not because I want to `change things up,` but because I analyze and judge everyone I meet upon every occasion I have. It also helps that my verbal IQ is off the charts (and therefore placed in the 99.99th percentile). This allows me to articulate and find words that accurately represent the people I meet, and understand them more. (Please note I am dyslexic and have processing difficulties which mean how I write is not representative of my verbal IQ because I can't process fast enough while writing to say coherently what I think like I can when I am talking. <\- example there)

(1) Analyze every person and remember it

The importance of what I am doing is used when I get in a sticky situation. _There are two types of people, those who give excuses, and those who solve problems_. I use what I learn and assume(#1) about people to describe to them in the most effective way possible what needs to be done. When I present ideas to people, I don't present ideas- _I present the problem and why the idea solves it_. (#1 cont. Don't tell a person what you assume about his or her character- not only is it unbecoming, it will probably piss him or her off unless it is a special circumstance)

(2) Become the person who is (known for) immediately _solving_ problems

I, unfortunately, break a commandment more than I should. I lie. When I lie, I don't think that the most important thing is not to get caught. I think about how the lie is helpful, and how I am going to expose the lie later ESPECIALLY if the person knows I am lying. For example, I had a tutor who was approaching a subject I could not talk about for a reason I will not explain. This is the kind of guy who will not accept an "excuse" for not talking about a subject regardless of the validity. In this circumstance, talking about the subject (it was personal) would be detrimental to our working relationship and the time would be better spent working on something else..So I lied. I did not lie elaborately, but I lied in a fashion where I knew he would believe me. Three hours after he left, I wrote him an email apologizing for my lie, explaining why I did it and the benefits it had. He was not upset about it, but understanding and appreciated the honesty, ironic huh?

(3) Choose your words carefully

Nothing is free. When you accept something from a friend, even if it is explicitly spoken that no strings are attached, you owe them. Of course this may actually be the kind of person where he or she truly believes that you do not owe them anything, but expect it. _When you deliver a favor, unless explicitly stated and agreed upon, the person receiving the favor owes you nothing_ , so don't ask for anything in return. I know, I am saying " _Be the person you do not expect anyone else to be_ ". However, if you want to enter show biz and need connections and will have to rely on people to make your way to the top, make damn sure you can rely on who you are relying on.

(4) _Low expectations cost you nothing, but let you reap the benefits of positive events_

Unfortunately, a lot of the _rules_ I live by don't allow me to be an open person. I don't like to talk about myself, ect. Today, I had a very in-depth conversation with a friend who I consider to be one of my closed friends. She is one of my closed friends because I know if were in another state- and I needed a way to get somewhere else, she would drop everything and drive cross country to help me. I talked to her today about some of my problems and I brought her to tears. She explained how she feels like she didn't know me very well and how she feels like she has failed as a friend because she didn't know me better, and she wished that she could have "watched movies and ate ice creme with" me during all the times I have had trouble because of depression or my pet dying ect. because that's what she would have done. I had to explain to her that it wasn't her fault but mine for being the kind of person who isn't sharing. At the moment, lots of bad things are happening to me even though I don't deserve them (I'm not going to talk to everyone about them, but I talked to her about them), and she got very angry, and didn't understand why I am so forgiving to others. Why don't I hold grudges? Why did I forgive her for being a "bad" friend? Why am I understanding when I _shouldn't_ be? Why don't I just accept (things)? I responded with,

(5 part 1) _Forgive and Forget(However, learn the lessons of the situation.), Cut your losses, Make your next plan, and execute._ [I'm clearly an introvert] (5 part 2) _Most heroes fail before they become successful_

Most of what I have said applies to my weird social situations. One last piece of advice which is on my mind- I have purposefully saved for last. When you are in egypt, please don't accept a tour of the mountains in the valley of the kings from a kind local (long story). Again, when you are above under-ground tombs and locals want to give you a tour. Please don't take it (long story). Furthermore, if you are going to take it, PLEASE walk behind them. (Again long story).

(6) _Just because you can, doesn't mean you should_ \- Well, that is all I can think of off the top of my head. This is unedited and probably contains errors. I can also see you saying I am FOS. But you need to realize, _We all live in our own world_. I'd appreciate anything anyone has to say to me- especially if you think I am FOS, but please- respond tactfully.

<comment><USER31> What's 'FOS' ?

<comment><USER25> Full of shit.

</comment></comment></comment><comment><USER32> May sound simplistic:

* Communicating with others what you feel.

* It is mostly chaos, everywhere.

* Do not drop your ideas thinking "Its so simple, someone must have already done it." People do much less that what you may expect"

* A very very small percentage of people within any system understand the "full picture"

</comment><comment><USER33> When dealing with someone, especially a co-worker, tell them about their mistakes privately and praise their succeses in public.

</comment><comment><USER7> Just wanted to say this is one of the best Ask HN topics ever.

I wish I had some street smarts to distill down to a comment, but it's difficult.

At 31 I feel like I'm getting my feet under me in that department a little bit. When I look back at myself at 21 it's almost embarrassing how naïve I was. I guess the biggest thing for me was just thinking more actively about other people's interests and motivations. It's sort of disillusioning and machiavellian in a way, but if you don't you will get taken advantage of.

</comment><comment><USER34> Mine: 1\. Loose lips sink ships 2\. There is no deal until a contract is sign, and then once a contract is signed, no deal until the check cashes. 3\. Have a good attorney

</comment><comment><USER35> The biggest thing I've learned over the years is to take into account different perspectives in any sort of situation. Whether it is conflict resolution or negotiations, you open up possibilities when you look at things in someone else's shoes. This also works great in problem solving. When I get stuck on a problem, I think about how a person admire might tackle the problem.

</comment><comment><USER36> Developing the core functionality is only 30% (or less) of the work, creating a finished product requires a lot of spit and polish!

<comment><USER37> Those are some pretty rough streets you run in.

</comment></comment><comment><USER27> People often criticize of their own weaknesses.

When making a sales pitch to solve a problem, confidence is _everything_.

Intelligence is not a scalar quantity.

When on the receiving end of a sales pitch, make sure that the technical guy making the pitch are actually responsible for the delivery.

Marketing and sales are generally more important than technology.

</comment><comment><USER2> From my grandfather: Be good if you can, and if you can't, then be good at it. Be good if you can, and if you can't, then name it after me. Be good if you can, and if you can't, don't get caught. Be good if you can, and if you can't, have fun.

</comment><comment><USER38> I've learned three things.

1) Most of the time stuff works itself out so long as you don't let it worry you too much.

2) Being _sincerely_ polite, courteous and helpful will take you a long way

3) If you get trod on, snap their foot off and beat them into submission (metaphorically).

</comment><comment><USER39> If you are buying something by weight, bring a scale with you.

To prevent people from stalling or from providing poor service, find something to threaten them with. Examples that I find myself saying frequently: "Let me talk to your boss", "I will report you to the authorities", "If you don't follow through on your end of the bargain, I'm going to take you to court."

A similar tactic: when bargaining, pull out the money that you're willing to pay, say "I'm willing to give you this much for that item, if you don't accept it, I'm leaving" - and then leave if they don't immediately accept. Usually you will have what you want at the given price within the minute.

</comment><comment><USER31> Many of the replies so far are more 'general life advise' answers. To me 'street smarts' is what the rich people that I know are - none of them have degrees, but they're all wealthier than the educated people like doctors, lawyers, engineers etc. around here. These are all people who run retail or wholesale businesses, small chains of Walmart-style shops, building materials, run contracting/real estate development companies, even fast food joints - that sort of thing. These people can't tell Australia from Africa if you give them a map, and none of them have ever heard about a sine or integral or Pointcare's conjecture, yet they drive Maseratis and have dozens of properties. Why did these guys succeed and others businesses fail or barely make enough to live off? That is what street smarts is to me, what these entrepreneurs have that made their businesses a success, and what others lacked.

Anyway in trying to identify the nature of this street smarts, I have analyzed some of these people that I know, asking them questions that are still appropriate (i.e., not straight-out asking them about money) and don't make me look like a weirdo as much as I could, and keeping in mind a certain sort of anti-intellectualism that many of them exhibit (and that, in some cases, has paid off very well for them). I recognize that my thought processes are so far away from theirs that it's very easy to fall back into cargo-cult imitation, but still, I think that a large part of their success is in their deal-making capabilities. This breaks apart in two phases: phase one is connecting to the right people, phase two is making the actual, concrete deal.

Phase 1 is facilitated by having a large network, just knowing many people, and this is done by being a person that people want to be around with - be a nice guy, but not a pushover, be confident, dominant without being an asshole, and be in general nice to be around. This is a hard challenge to me, it isn't easy to get to know as many people as possible, letting them know what you do and finding out what they do, and making that all happen naturally. E.g. it's easy to 'meet' random people by chatting them up in the supermarket - but how will you tell them what business you're in? Smalltalk about the weather will only get you so far, how do you (efficiently, i.e. without turning them into full-blown friends with the associated time investment) get them to the point where they remember you as the go-to guy in your line of business, or get them to the point where you can call them when you need something, so that you always have an 'acquaintance' for whatever you need, who you can call?

Then there is phase 2, which can basically be summed up by "at any point in any any negotiation, you need to remain willing to drop everything and just walk away". This means being very aware of cognitive biases such as loss aversion etc. You have to be tough as nails here - be on friendly terms with people, so that they want to help you out, yet not exploit them because that will blow your relationship with them. You have to get people to a point where they are _happy_ if they can do you a favor.

This is already getting too long, but let me share with you one (in my opinion) example of 'street smarts' that the Belgian and German readers will recognize: the soccer keeper (goalie) Jean-Marie Pfaff. He used to be the keeper for the Belgian national team, he also played for Bayern Munchen in the 90's I think. Anyway he has a reality TV show now, his daughters are models and kinda famous so they all ride the tails of his fame now, kinda like Hulk Hogan.

Anyway like I said, he has this reality TV show. In one episode, and this really struck me, there was a guy who was living in the same village as Jean- Maria and he came to the door of his villa, rang the bell and dropped off a bag of potatoes. Not ordered or anything, he had just harvested, has potatoes, and thought to drop off this bag. He was so eager to please this rich/famous guy that he'd out of nowhere brought him a 3 euro bag of potatoes. That, to me, means that this Pfaff guy has street smarts - he manages to be so likable that people that they do thing they'd not do for others.

<comment><USER40> 100% agree with parent. I guess I subscribe to more or less the same notion of what street smarts are.

To me it's all about people and relationships. The older I get the more I evidence I have in support of this simple fact.

I was a CS major once, and I thought it was all about technology. That it was technology that changed the world and drove progress, saved the day and dashed out miracles. I thought that building something created meaning and brought satisfaction to the builder, and naturally I also believed that good builders were the most successful ones. But it's not that. The successful builder is the one who understands those he is building it for and those he is building it with. That's what sets success apart. Then there is socioeconomic background and all that.

Understand life is precious. Value other people. Never be a means to an end for someone else. If you are, get out of that situation as soon as you can.

Hold your ground for things that matter. If you think something matters think about whether the things you thought mattered 5 years ago still matter as much now. Pore over your decisions, and learn from your mistakes.

Learn what motivates people. This is especially hard to do when you are an introvert, which many people with engineering background tend to be. The reason it's difficult is because most people are motivated by other things. Once you get a handle on what motivates those around you, learn to motivate and influence other people. I don't mean use, I mean lead. I don't mean cheat, I mean compromise.

Separate business and family life. This goes back to knowing what really matters. Jobs come and go. You only get a few shots to surround yourself with the right kind of people for the long run.

No matter what you do, never lie to yourself. This is probably the worst thing you can do, as far as I am concerned. Much better to live with not so pleasant truth than to live a life of self-deception.

Just my 2c.

</comment></comment><comment><USER41> Have compassion. Without compassion, I would not have saved someone very close to me from debilitating alcoholism, I would not have worked my life around to be able to work on a startup for the past six months (and know I will have the support to make it from those around me). All those 'smart' actions, words are only sustainable if they are the consequence of something deeper.

</comment><comment><USER42> The longer it takes to learn a lesson the harder it will be when you do.

</comment><comment><USER13> Here's what I've learned - pretty much all the hard way.

I guess most people will focus on business facts, but underneath all those are human facts… and those lessons are what I consider the most valuable.

1a. Life is suffering. No, really. Accept it and then you realize that basically to have a body & a consciousness is to suffer, and a lot of it is unavoidable. Then you don't feel like just cuz something hurts, you have to change it. Nerves will always hurt. Once you can accept it, you can stop wasting your time on the pointless shit.

1b. Emotions are like weather, sometimes they don't mean anything… and just because you feel something, doesn't make it true. (Good OR bad.) Just because you feel like something is happening TO you, doesn't make that true, either. It's usually not actually about you. And if you assume that good feeling = good thing/I'm right, or that bad feeling = bad thing/this is wrong, you'll be analytically hobbled.

(These sounds harsh, but think about it.)

2\. Most people don't live their lives by deliberately examining their actions & beliefs and deciding what they want to live up to. If they have integrity, it's often by 'accident,' not design, so if you deal with a person who works with integrity once, they may not next time. There's no point in blaming them if you assume wrongly about them.

3\. Some people think on, & play, a meta-game. If you don't, you have to learn, because there will be people around you playing at 30 levels deep and if you just believe the surface level, you will come away with an incomplete picture.

4\. Really failing, getting kicked in the face by life, is awesome, because you can only know how much you can do when you have to crawl up from rock bottom. I could go broke and become homeless tomorrow, and it would suck, but I wouldn't be afraid. I could work my way up (again). But before the 1st time, I was terrified all the time by nameless middle class angst about the silliest little things, because I had never been tested, and I had never proven myself.

5\. We're all human, so we all have the same basic flaws. People live locked up in their own little heads, thinking they are better or worse than other people, not realizing that's just a trick of being only aware of your _own_ consciousness. It's also easy to look at other people who have a great-looking or terrible-looking life on the surface, and make incorrect assumptions about what's going on inside them, and how they got there. Your problems, flaws, limitations, are not special, and neither is your defense of them. (And neither are other people's.)

6\. Being true, having integrity, and loving people are the best things in life. Consciously deciding to have integrity and take responsibility for my life was the most important thing I ever did. Consciously deciding to stop letting my fear of social situations conquer me, and go out there, and expose myself, and be the friend I wanted to have, led to the first true friends I'd ever had (and many more after that). And consciously deciding to stop beating myself up over mistakes I'd made, to look at them, accept them, and understand that I'm only human, made a huge difference in my well-being.

7\. When you've suffered, don't look at other people suffering and say "Well, I did it, why shouldn't they?" -- think expansively, givingly, compassionately. Everyone will be happier.

8\. It's almost impossible to help people if you don't understand people. But truly understanding yourself, 100%, and being mindful in your daily life, will help you understand what it is to be human, because you will see all your little evasions, flaws, wiggling -- and your pleasures, joys, and little moments of happiness and insight.

9\. (And, by the way, the best products show a true understanding of what it means to be human.)

I consider people my mission.

<comment><USER43> Life is _not_ suffering.

* When I am unhappy it is because I'm focusing on what I am not, and what the end result should be.

* If I focus on the process and the problem at hand, and I focus really hard, I will not have any more brainpower to think about things that make me unhappy. I get absorbed in the moment, and nothing else matters, but what I'm doing right now.

* Also, if I focus on the process, I will be able to give the best solution I'm capable of, because greedy, envious and ego-driven feelings will not distract me.

I do not see (rationally speaking), how I can get unhappy if I manage to keep this mind state.

[http://www.ted.com/talks/lang/eng/srikumar_rao_plug_into_you...](http://www.ted.com/talks/lang/eng/srikumar_rao_plug_into_your_hard_wired_happiness.html)

<comment><USER13> Emotions _are_ like weather. You can stick to your regimen forever, and you're still going to feel down sometimes, even if for absolutely no reason at all. That's totally normal cycles of chemistry.

And yes, life is suffering. You stub your toe. You think it's too cold, or too hot. Somebody doesn't look at you the way you want. Your tummy hurts. You constantly have to 'battle' against focusing "on what you're not," for example. You have a hard time focusing. You look at books, things, places, scenes, and people (hey, and HN comments) and they feel WRONG. You don't like them. You judge them. You judge everything by your yardstick.

That is all suffering.

That's the human condition: judging, and struggling, and hurting.

It doesn't say there aren't OTHER things, but the suffering is always there.

<comment><USER43> >>> You constantly have to 'battle' against focusing "on what you're not,"

Well, I don't have to. If I focus on the problem I'm facing probably I will be happy with the outcome.

One thing is for sure: My "focusing on the problem" self can beat my "focusing on what I wish I'd be" self any day.

<comment><USER44> Programming helps here. I got a lot better at doing this in everyday things when i got a lot better at programming.

</comment></comment></comment></comment></comment><comment><USER45> BE SO GOOD THEY CANT IGNORE YOU

<comment><USER46> It seems your philosophy is more along the lines of "Be so loud they cant ignore you" :)

</comment></comment><comment><USER47> People are always acting in their self-interest, whether they're aware of it or not.

If you're going to engage in criminal behavior, don't: if something goes wrong you have no recourse.

</comment><comment><USER48> Hitting people with a house brick makes them stop chasing you.</comment>


A new standard for artist portfolios - works-io http://www.works.io

<comment> works-io You are a fine artist or you know any that struggle with managing & building their career - here is our solution to get thing done quick, easy and clean.

Any feedback is more than welcome.</comment>