MOOCs are closed platforms and probably doomed - <AUTHOR> http://lemire.me/blog/archives/2014/12/24/moocs-are-closed-platforms-and-probably-doomed/

<comment><USER3> > If your course requires that prospective students "register" to access the > content, then it is not an open course. It might be an online course, it > might even be massive, but it is not open.

That's the last sentence in the 4th paragraph of the article.

"Open" can indeed mean a lot of things. In this case of MOOCs, it just means anybody with an Internet connection can register and take any course - <USER2> free. Coursera and edX are prime examples.

Making registration a prerequisite for taking an online course does not invalidate it's openness. It's mostly an administrative thing. So the author's argument does not hold.

<comment><USER4> edX meets certain definitions for Open that Coursera does not, in terms of licensing of content and software.

<comment><USER5> What's the percentage of edX courses that are actually CC licensed?

As a quick and unscientific experiment, I checked out the 12 courses listed on the edX.org homepage and none of them were CC licensed.

With Google I found a few CC licensed edX courses [0:2], but looks like they're the rare minority.

[0] [https://www.edx.org/course/introduction-aeronautical- enginee...](https://www.edx.org/course/introduction-aeronautical-engineering- delftx-ae-1110x)

[1] [https://www.edx.org/course/business-its-environment- overview...](https://www.edx.org/course/business-its-environment-overview- oecx-bp111x)

[2] [https://www.edx.org/course/introduction-functional- programmi...](https://www.edx.org/course/introduction-functional-programming- delftx-fp101x)

</comment></comment></comment><comment><USER6> The author of this post starts with an incorrect definition and build his argument from it: "Open" in MOOC does not refer to the software used but the fact that anyone can take those courses (open enrolment).

</comment><comment><USER7> I would argue that the problem is signaling. Where and what you studied in school are signals employers use to rank you against your peers. IE going to Harvard signals that you are the elk that got into Harvard. No one really cares what you studied there. This is the primary function of college in the employment landscape: signaling. Very few people go to college for the actual learning (they go to get the signaling that will allow them to get a job).

MOOCS would need to get into signaling and have employers take their signal seriously. I hate to sound classist, but unfortunately MOOCS lack of selectivity means they don't signal as much as a college with a low acceptance rate.

I myself did not go to an elite school, and realize that the above is a very broad generalization...

</comment><comment><USER8> The argument seems to be that MOOCs are the online equivalent of lectures. Therefore, since lectures do not seem to hold much financial value to customers, MOOCs will not either, since they consist mostly of online lectures.

Though this may be true in practice for some MOOCs, I suspect that MOOCs are attempting to become the online equivalent of a university, rather than just lectures.

With an online university, you are paying for the course curriculum, online tools, office hours, graded results, certification, social network and the brand of the institution. The combination of those things holds more value than the lecture itself.

<comment><USER9> > With an online university, you are paying for the course curriculum, online > tools, office hours, graded results, certification, social network and the > brand of the institution.

An essential thing missing from MOOCs is the feeling of being personally supervised and accountable to someone (our teachers or their assistants). It might seem just emotional fluff, but it is essential in getting people through long courses.

I think MOOCs should be paired with in-person supervision, the kind offered by a coach or an educational advisor. Other people should still be involved in the loop, it must not degenerate into a solely man-computer thing. MOOCs need more emotional grounding to help decrease the atrocious drop rate.

<comment><USER10> _MOOCs need more emotional grounding to help decrease the atrocious drop rate._

I see many people express concern about the drop rate of MOOCs, but I haven't seen any good arguments as to why it is a problem.

I've signed up for several courses, and not finished one of them! So what? I didn't cost me anything, and I didn't hurt anyone by taking up a spot in the class that would instead have gone to a more deserving student.

In a couple cases, it is simply that I've got a more than full-time job, and I just don't always have the time and energy to work on a class too. If I'd been paying money for it, I probably would have taken it more seriously, but oh well. I still learned something from most of them, and it was in general worth my time to at least listen to the lectures and look at the homework assignments.

I'm still working through one of them... slowly, interleaving it with all the other things occupying my free time.

</comment></comment></comment><comment><USER11> > _we live in an era where Amazon can deliver a textbook on any topic directly > to your door within 48 hours. In this era, it is much better to sell > diplomas and degrees. Unlike lectures, they have tangible financial value > for the students_

This is too true. Anyone sufficiently motivated may teach generally any subject to themselves to whatever degree of proficiency they desire. This is especially true of CS. The degree, not the education, is what you're buying.

</comment><comment><USER12> I don't entirely agree with the assertion that you cannot charge for content. E.g. "It is probably harder to make a living selling lectures than it is as a journalist, and it has become nearly impossible to live off journalism."

I made a substantial chunk of change this year delivering training. The difference is people can directly connect training to revenue. In my case I'm teaching Scala, where my course attendees either need it for their job, and know that getting Scala on their resume will open up some very well paying gigs. In this situation people will pay for a directed introduction to a topic, and also to clear the time on their schedule.

The problem faced by good Universities face is that they are teaching foundations not ephemera, and most people have difficulty connecting the dots from learning, say, mathematics, to revenue. Which is a real shame, because foundations are far more valuable in the long term.

FWIW, our Scala courses try to sneak in foundational material while no-one is looking. :)

</comment><comment><USER13> Playing devli's advocate so are Colleges are those also doomed?

Looking at this article makes me think of what if we made a course an open platform. Maybe take moodle or some other system and merge it with a wiki and create courses with it. Might be interesting.

<comment><USER14> Yes. A rough analogy:

      College   : Proper MOOC  : Closed MOOC ::
      Newspaper : Online Media : Paywalls

<comment><USER15> I don't think that analogy holds up well. For newspapers -- an AP article on the New York Times website has the same value as an AP article on any other website. More broadly speaking -- the content is what's valuable here, and if you offer the same content, you offer the same value to readers.

As the author himself notes:

"What colleges do not do, at least on campus, is to make money off course content. As it is, you can easily order all the textbooks you could possibly read on Amazon. You can join discussion groups about them. You sneak into lectures, or find tons of them online. There is simply little value in the course content."

And yet, the vast majority of people are paying for this content, rather than applying the author's cost-saving measures. Why? Because there IS little value in the course content. But that's NOT what colleges are selling. They're selling credentials. In this case, getting the content from Harvard IS different from getting it off a Github repository. Why? Because there's a mechanism at Harvard that signals to other people what kind of content you have learned from them. The reason that the analogy to newspapers isn't a perfect one is because accreditation solves real problems for consumers of college -- it lets them demonstrate that their credential has value.

Paywalls are "bad" because they restrict sharing of content. For news articles, that's bad. People want to be able to share articles they find interesting -- on Facebook, on Twitter, on Hacker News and Reddit and via e-mail and so on and so forth. Paywalls reduce the number of people I can discuss content with, and thus reduce the value of an article to me. With credentials, you don't have that effect -- a credential is MORE valuable to me the harder it is to obtain, because the credential then gives off a stronger signal that I have demonstrated my worth.

Now, MOOCs target a wider audience than the people looking for credentials. But their revenue streams almost all come from credentialing. And so I don't think that closing a MOOC has the same effect as putting newspaper content behind a paywall.

<comment><USER3> I think it's wrong to posit that colleges are selling credentials. When you enroll at any college, what you're actually paying for is the content of the courses that you'll take for the duration of your enrollment. In other words, you're paying for the quality of the education that you'll receive.

So no, real colleges are not selling credentials. Sure, you can buy a degree online, if you know where to look, but that only gets you a useless certificate.

<comment> vertex-four > In other words, you're paying for the quality of the education that you'll > receive.

Sort of, ish. There'd be a lot fewer people going to uni for the abstract concept of "education", especially at what it costs in the US - the reason that many people go to uni is that you can prove that you've been educated under such-and-such a standard to future employers. That's credentials, and that's what people are looking for from a college.

</comment></comment></comment></comment></comment><comment><USER16> Other closed platorms, probably doomed: Facebook, Twitter, Instagram, Snapchat, Google Maps, YouTube, Uber, iPhone.

</comment><comment><USER17> A MOOC is analogous to a textbook.It's content, not a meet up. It can be consumed asynchronously.

</comment><comment><USER18> Like Coursera, Hacker News requires registration before one can participate.

Help, help, I'm being oppressed?

Funny, I don't feel oppressed.

</comment><comment><USER19> Good to know, however atm they do offer free access to education for many people who cannot get it or afford it through normal means.

And even the "premium" ones which usually offer full or partial degree accreditation cost significantly less than traditional eduction.

And while many of them might be too "closed" for the usual suspects and champions of freedom it's more to do with the fact that they do offer some certification and credit and so have to be monitored.

I understand why Coursera does for example require sign up and participation in a specified time frame this is so people can go trough the course as a group, study together and learn from each-other just as much as they do from the course.

The courses are also overseen by lecturers which offer help and guidance.

And since you do get a certificate(which value is yet to be determined) they do need to have a strict and repeatable curriculum.

I have a feeling that the writer of this article as many others confuses a MOOC with a library. A MOOC is not an arbitrary source of information or a "lecture on demand" service, it's an education platform.

This is why the lecture library which Standford uploaded to youtube since like what 2009 is not a MOOC, in fact i would go as far as saying that most "examples" the author provided in his article (although nameless) are not MOOC's..

A "MOOC" is still a course whether it's online or not and to be so it has to provide a structured environment for it's curriculum. It's should be seen as an evolution of the long distance courses many people have taken for over a century not some podcast you throw on your smart phone or tablet while you take the train to work.

People who treat MOOC's as educational materials and take them seriously benefit from them, people who take them as some instant "smart pill" content that they absorb on the tube can just as well read the free daily papers...

So yeah while bloated smarty pants like the author might bicker and moan about just how bad and doomed MOOC's are I'm sure the tens of thousands of people from Asia, Africa and the Middle East who are lucky enough to have internet access do find them quite useful.

Heck I've seen class A universities steal i mean "borrow" material from Coursera, edX and from Standford (and others) video lectures plenty of times. Especially in new subjects ranging from video game design to information security.

So i guess the material is good enough, and when the educational framework is actually structured people actually benefit from the materials and no only parrot them to feel smarter.

</comment><comment><USER20> one more point they're publicly funded. that should be at least motivator to open up

</comment><comment><USER21> This is a problem that I'm working on, so it's nice to see others discussing it too. Most of the MOOC providers are "open" to learners but relatively "closed" for contribution -- edX for instance is exclusive about which institutions can join. (And takes a hefty fee from every institution that does join.)

All of which may be perfectly nice if you're an interested-but-casual learner wanting to watch some courses that have had $100,000s spent on the video production. Or if you're a high profile university wanting to advertise your wares. But not so much use if you're a humble engineer-turned-CS-lecturer wanting to collaborate with your colleagues to make things better for your students (or, therefore, if you're one of their students!)

At UQ, my institution was a member, but with a curious process about how to get a course approved (and unlikely to approve a junior contract academic like I was). Moving onto faculty at the University of New England (Australia), UNE isn't a member so I wouldn't be eligible.

So, I'm busily working sharable course models, and making things open-to- contribution.

At UQ I co-designed a rather unusual studio course (with 200 students programming together on the same codebase). Initially I was looking into offering this as a guerrilla MOOC (without official backing) and opening the content up for reuse. I gave a talk at ICSE in July 2014, where I also tried to "get a gang together" to make it a community effort bigger than just me, and the response was interesting -- some other junior academics wondering about putting some of their students on our project.

And as I'm moving to UNE to help redesign their CS degree, I'm already going to be an early example of a "fork". Especially as where we had 200+ in-class students at UQ, many of the students at UNE will be remote, so I'd need to change a few things.

Most of the material I've put up online is about the studio course, but the sharable course model is also in progress

Recent talk I gave to OSDC: [https://www.youtube.com/watch?v=SULsMJCNAYM](https://www.youtube.com/watch?v=SULsMJCNAYM)

Website about the studio course concept: [http://www.supercollaborative.org](http://www.supercollaborative.org) (due for an update -- 2014 course numbers jumped from 140 to 200 and had a different project)

Of course, Armidale NSW isn't exactly Silicon Valley, so I don't have VC rocket fuel or marketing/publicity/etc. So expect a little duct-tape-and- string early on. And I did way too much theatre as a PhD student in Cambridge, so apologies for the vanity hey-I-get-to-do-video-teaching-now aspect of it.</comment>


Cross-Site Websocket Hijacking (2013) - <AUTHOR> https://www.christian-schneider.net/CrossSiteWebSocketHijacking.html <comment><AUTHOR> I'll note that OWASP ZAP scans don't appear to be picking up on this vulnerability :(</comment>


Ask/Propose HN: What to Do with Just Acquired Local Business Directory? - <AUTHOR>

Hi guys I just acquired a friend's local business listings website
http://www.queensmetro.com/
It's a local website for Queens, New York.  However, I am a California kid who has only been to NY once and as far as I know never been to Queens.  My friend has been developing this space for a little over a year but he will be moving to Asia and I helped him out by acquiring it.
I would like some opinions on how this site can be pivoted towards a broader audience since it basically functions like a local Yelp site.  And if anyone from New York area specially Queens would give some good inputs on the potential of this website it would be much appreciated.
Personally, I would like to meet a hacker from Queens area who would like to co-develop this site further for a mass appeal.  I know it has potentials and my friend obviously worked hard on it.  It just need a little bit more elbow grease.  Please contact me if you're interested.
Thanks for reading! <comment><USER2> Why are you looking for someone in Queens if you're in California, and you're trying to pivot to a broader audience?

The site's a mess. I'm sure your friend worked hard on it, but this is nowhere near being able to compete with Yelp, even locally.

I'd bet most of the traffic is coming through the Guides and Resources section of the site. The business directory portion is crap. Your assets are content and domain history, which are providing search traffic.

My advice would be to move business listings to the back, move content to the front, hire writers to create more local content, and monetize through local affiliates.

If my assumptions are off, please post some Google analytics data so we can see a more accurate picture of what you're working with.

<comment><AUTHOR> Hi JN, thanks for your inputs. I do have some GA data that I would like to share with you via email if you have sometime to leave me some more valuable feedback.

<comment><USER2> Sure thing. jay [.dot.] neely [@at@] SocialStrategist [.dot.] com

</comment></comment></comment><comment><USER3> Clickable: <http://www.queensmetro.com/>

Looks quite nicely done already. One quick suggestion: You might want to look into some basic SEO for the site. A few pages I browsed all seem to have the same Title tag - I think it'll certainly boost (targeted) traffic if you customise just the title tag of each page.

HTH and all the best moving forward.</comment>


Reddit's Female Dating Strategy offers women advice - <AUTHOR> https://www.theverge.com/2020/2/14/21137852/reddit-female-dating-advice-strategy-women-rulebook-memes <comment><USER2> >Women are encouraged to not disclose their sexual history to partners or have sex too soon because they believe no man would ever love a woman who has sex quickly.

>they do not support consensual BDSM, viewing porn, or having sex before commitment has been established in a relationship

>Similar conservative guidelines ("don't rush into sex," "let him take the lead") were promoted as dating advice in books of the '90s and 2000s such as The Rules: Time-Tested Secrets for Capturing the Heart of Mr. Right.

>Like pickup artists, Female Dating Strategy often objectifies the opposite gender and turns dating into some sort of game to be won — just in their case, it isn't having sex that's the prize, but finding a High Value Male.

Yeah this is basically redpill/PUA crap combined with a hearty dose of American puritanism. Maybe both men and women who believe in this stuff should find each other instead of trying to give advice to the rest of us.

<comment><USER3> >Yeah this is basically redpill/PUA crap combined with a hearty dose of American puritanism. Maybe both men and women who believe in this stuff should find each other instead of trying to give advice to the rest of us.

I'd say it's better to demonstrate what's wrong with their advice instead of labeling them and rejecting everything they say or stand for outright.

>Maybe both men and women who believe in this stuff should find each other instead of trying to give advice to the rest of us.

Their strategy doesn't work if other options are available. If you demand herculean efforts in order to reach intimacy then highly likely the partner will lose hope or give up and go for someone easy and if this happens many times then the person demanding efforts is going to waste a lot of time without running into someone who is ready to expend that much effort. But yes, if everyone demands herculean effort then probability of finding someone who puts herculean effort goes up drastically.

<comment><USER2> I don't get this comment. Subjectively, how am I supposed to justify that I find PUA crap repulsive? I just do. Objectively, how am I supposed to prove that it's of any use when literal billions of people live happy relationships without the use of any of that stuff?

>Their strategy doesn't work if other options are available.

Maybe they should rethink their _strategy_ then (by the way, what a lovely word to use when dealing with romantic interests).

<comment><USER3> >I don't get this comment. Subjectively, how am I supposed to justify that I find PUA crap repulsive? I just do.

FDS differs from PUA in that they want to settle for a man who is valuable to them and PUA just goes through women one after another even if you manage to get laid with one woman, it doesn't stop anywhere.

>Maybe they should rethink their strategy then (by the way, what a lovely word to use when dealing with romantic interests).

>Objectively, how am I supposed to prove that it's of any use when literal billions of people live happy relationships without the use of any of that stuff?

We don't know that billions of those people are happy. Were slaves happy before slavery was abolished? Were women happy before feminism?

I am a guy who never used to get much attention from women but I read FDS and I see lots of women there have had very bad experience with men who they just fell in love with, who they didn't clearly vet and they suffer consequence of this in terms of abuse, being raped or consigning debt etc...

Their strategy is now focused on avoiding those men who have destroyed their life.

</comment></comment></comment></comment><comment><USER4> I've never posted in that sub. You can prove it by auditing those deleted comment checkers. But, I just found out I was banned. You only get a ban PM message on reddit if you had a post/comment.

My guess why I was banned? I made one or two comments outside the sub promoting a non-toxic alternative called [https://www.reddit.com/r/TwoXDating](https://www.reddit.com/r/TwoXDating)

<comment><USER5> A lot of subs will auto-ban users that have ever posted in another sub that they consider objectionable.

</comment></comment><comment><USER5> It's good reading for those who might want to date females as well.

<comment><USER6> I believe 'women' is the idiomatic usage in English.

<comment><USER7> Artistic license for r/FemaleDatingStrategy

</comment></comment></comment><comment><USER8> I have a rough, reaching hypothesis about the rise of incel, MGTOW, Hikikomori and FDS that hinges on a number of socio-economic, technological and population factors. Attitudes and lifestyle choices are "soft" means of reducing an individual's procreation to reduce over-population, whereas "hard" means such as famines, war, mass shootings, taking away healthcare and genocide are the more painful means to reduce numbers.

The inflection point of global population happened somewhere around 1962-1965 when it went from concave up (growth phase) to concave down (slowing phase). Population still continued to increase in many parts of the world, but it's the rate of change that slowed. In many ways, overall population is best modeled by a different equation, but the carrying capacity is variable including place-to-place, time, technology, food, economic and political concerns.

Even though population slowed, it still kept increasing. With a larger population, resource scarcity plus labor over-supply increased in first-world countries and so the ability to start families decreased. People who are relatively rich have an easier time having children than most people when the average purchasing power and average income is reduced. More inequality + more access to reproductive services -> fewer families -> fewer children.

The sexual revolution and The Pill happened around this time, increasing the number of divorces and reducing the number of formed family units. (Birth control isn't anything new, as Silphium was a cash-crop in the ancient world that was harvested to its extinction.)

Delaying marriage also reduces the number of births. It was the case in the 19th century that girls were having children at 15-16 through their late 20's, so family sizes were on the order of 6-10 children per couple.

One point that goes against the trend is modern divorce (with a prenup and in a non-community property state) allows a high-income earning man to start multiple families serially.

Women gained more access to the means of income earning, removing dependency on men. As such, many women's time and priorities were taken-up by work, and so starting a family was no longer a primary motivation.

Alternative lifestyle became more acceptable as population increased. The previous modality forced some people who were uncomfortable with heterosexuality to have families and children, but who wouldn't have passed on their genes to a new generation in the new modality. Furthermore, individuals in the modern era, not necessarily for sexual or gender reasons, adopted new and various subsets of lifestyles that also reduced and limited their reproductive success.

In conclusion, I think it's important for any wise person to not capriciously lash their identity to a random cult, external attribute or way that contains a lot of negative, judgmental/stereotypes or arbitrary "rules," and to use some common-sense, nuance and love rather that bitterness, scorn or hate.

<comment><USER6> Won't natural selection take care of this within a few generations? The 'career women' and 'divorcee' genes get heavily selected against, and those with religiosity get heavily selected for.

We already see this in some Western countries where Muslims have much higher birth rates. Also in the US, we have the Mormons. If this development continues, it is not unlikely to see a return to historical, more efficient, social norms.

<comment><USER2> Ah yes, the famously identified "career women" and "divorcee" genes with well- known genetic pathways.

<comment><USER6> Yes, everything is genetic. Can't speak for divorcees, but the career women I've met have generally been more 'masculine', so to speak. We know that 2D:4D is genetic and has a strong correlation with leadership ability, so it wouldn't surprise me that such could come to be selected against in women.

Religiosity is genetic, and that has quite strong effects on fertility.

<comment><USER2> I don't think _genetic_ means what you think it does. In the _field of genetics_ , a trait is said to be _genetic_ when a _genetic mechanism_ has been identified leading to the expression of that trait. Please, tell me more about the genetic mechanism behind religiosity, let alone 'everything'. Which genes are involved, how does the epitaxis play out, which pathways are influenced?

<comment><USER3> >Please, tell me more about the genetic mechanism behind religiosity, let alone 'everything'. Which genes are involved, how does the epitaxis play out, which pathways are influenced

I've seen people here claiming that Asians are more conformists they've been selected for conformity from the time where your books were burnt if they were not allowed by the Chinese empire.

>Which genes are involved, how does the epitaxis play out, which pathways are influenced?

We know tall stature is genetic trait and we've many genes which correlate to tall strature. We don't know pathway which causes tall structure. So can you tell me which pathway makes a person tall? Should we stop believing tall strature is a genetic trait even if partially?

Similarly, there are gay or transexual people - we don't know pathway, are you going to claim that its cultural? There are many gay in Muslim countries or India where they were not socially accepted for long time.

There have been experiments on mouse where when they injected q mouse with testosterone, they became more dominant and fought more fiercely against the bully.

Similarly, there are accounts of trans people who went from female to male - and became more competitive, aggressive, dominant.

It's not far fetched to think there are hormones which turn depend on genes or environment which make a person more "individualistic"

In psychology, we know of this disorder Borderline Personality Disorder which sometimes is genetic and sometimes not. It's a very individualistic disorder and person suffering from it finds it hard to keep meaningful relationships for long term.

We don't know if it's caused by hormonal imbalance or genetics or some brain anomaly.

Similarly, depression is contender for genetic trait yet we don't know any pathway.

So what's my point? Asking for specific genes or pathway is not going to invalidate the hypothesis that a particular personality trait might have genetic basis</comment></comment></comment></comment></comment></comment>


Show HN: Prefab Home Marketplace (No-Code) - <AUTHOR> https://www.dwellito.com/?hackernews <comment><AUTHOR> I'm Caleb, the maker of Dwellito. It's a no-code project for prefab shopping - think backyard guest house that you can rent or use for family / friends.

I just launched Dwellito 2.0 with 40+ prefabs (w/ kitchen & bathroom), starting at $18.5k and up. We redesigned the site so you can deal shop and compare. Our goal is to help cut through the noise since the prefab market is a pain to navigate.

What do you think of prefabs - would you buy one to rent, to office, to house your family? Would love to hear your feedback.</comment>


China: the coming costs of a superbubble  - <AUTHOR> http://www.csmonitor.com/Commentary/Opinion/2010/0316/China-the-coming-costs-of-a-superbubble

<comment><USER2> This article is basically political bullshit masquerading as some sort of prediction.

Where exactly is this bubble? The author's logic appears to be: "China has defied the recession, therefore the economy is a bubble!"

China's economy has been turbulent over the past 30+ years, but with a lot of saved money (both at the personal and government levels), they've been able to weather much worse than the US's current situation. Massive unemployment, food shortages, inflation, you name it, they've been there.

But for a "bubble" to be afoot as suggested, there really should be speculation of some sort going on, which the author doesn't even go into. Sure, the price of real estate has tripled in the past decade in many areas of China (which he also doesn't mention), but for a nation bent on saving money rather than massive mortgages, it's not clear whether that's really a bubble or just what people can actually afford.

High GDP growth at this stage in China's development doesn't mean it's definitely a bubble either, nor do they have to keep it up. It's like a start- up who get's 80% traffic growth on their website every month for the first 6 months, it will slow down eventually and that's ok. China doesn't have to keep this rate of GDP growth to keep people happy: a higher standard of living will do that too.

China is complex and our understanding of their society and economy seems poor at best. People like this author don't help.

In any case, there are valid arguments (both pro and anti bubble), but this article is missing a lot.

<comment><USER3> I think the logic is sound. Miracles don't always happen, and anything miraculous deserves at least some suspicion.

The price of real estate has tripled, while the GDP hasn't. Clearly, not all the people can afford the price.

<comment><USER4> _> In any case, there are valid arguments (both pro and anti bubble), but this article is missing a lot._

so why don't you mention some of the arguments he missed, because I can't see any?

</comment></comment></comment><comment><USER5> He doesn't think much of China's infrastructure build out (based mainly on the possibility that it is inefficient or overheating). But perhaps overseas student numbers are more revealing - presumably education is valuable even if infrastructure isn't.

I had a dig around for some statistics, and found the Australian government page on this:

[http://aei.gov.au/AEI/MIP/Statistics/StudentEnrolmentAndVisa...](http://aei.gov.au/AEI/MIP/Statistics/StudentEnrolmentAndVisaStatistics/Default.htm#data)

Statistics for China:

2005 - 84,476

2006 - 93,533

2007 - 110,846

2008 - 131,210

2009 - 154,777

That's 17% growth from 2008 to 2009. (Incidentally US figures have gone down.) Not a perfect proxy for economic growth, but then what is? There may be a bubble here and there, but on the face of it China seems to have a lot of advantages.

As for not having a social safety net, it appears they've thought about the one:

[http://www.google.com/hostednews/ap/article/ALeqM5jGQDE0Z2Lb...](http://www.google.com/hostednews/ap/article/ALeqM5jGQDE0Z2LbFGRirzDQTs81WGjXlAD9EAVR800)

I don't know if China's stimulus is as distorting as the article suggests, but it seems to me that now is as good a time as you're going to get to spend your dollars overseas if you've got some spare. I wouldn't bet on the stories about new investments in solar power, African minerals, and high speed train networks drying up just yet.

<comment><USER6> I don't think that reflects the current economic fact by evaluating oversea student number. The way families in China to collect tuition towards college is much like many families in the United States. They just start early. Thus, it cannot reflect the economic status at this very moment. Besides, although whether true or not is unclear, I do believe Asian families in general are more willing to invest in education. The number of people who is taking National College Entrance Exam is dropped from 2008. It is a safe bet that the number of oversea student will drop in 5 to 6 years (due to the birth control policy).

</comment></comment><comment><USER7> Far too short an article for such a topic, it should be at least 6 pages. There is far more that needs to be mentioned to even give half the picture.

<comment><USER4> it's just a very general and simple to understand article in a Christian Science Monitor.

author has an interesting site and a book,

<http://contrarianedge.com>

for those like me who want to investigate further.

<comment><USER5> I voted you up. Thanks for the link to the site, I also wanted to investigate further.

It does look like he repeats the same story a lot on that site. Here's a very similar story from 2008:

[http://contrarianedge.com/2008/08/21/chinese-and- starbucks-l...](http://contrarianedge.com/2008/08/21/chinese-and-starbucks- late-stage-growth-obesity/)

There are other presentations and interviews where he repeats these arguments. While there is definitely a bit more detail and statistics on the site, it's not significantly more. And articles like the one below where he is correcting his own back-of-the-napkin estimates don't inspire confidence:

[http://contrarianedge.com/2009/07/30/reappraising- china%E2%8...](http://contrarianedge.com/2009/07/30/reappraising- china%E2%80%99s-%E2%80%98staggering%E2%80%99-growth/)

Interesting quote from him: "Maybe it is the pessimist in me, or maybe I've written so many "China will slowdown articles" that I am looking for data confirming my view (the confirmation bias) – that is possible, I am human after all."

And another which I think is quite a good summary of his arguments:

"I have absolutely no facts to back up what I am about to say, but it is not hard to imagine future stories about poverty stricken farmers that moved to big cities for a better life and found despair; or that inland migration (from farming to factories) only brings a onetime productivity jump as poorly educated farmers-turned-factory-workers add little to productivity improvements afterwards; or how weak and debt ridden the financial system is; or the devastating impact that pollution has on health and productivity; or how the biggest shopping mall in the world, that happens to be in China, is almost completely empty. "

The book appears to be fairly generally about trading rather than being focused on this particular question.

All in all, I'm still left thinking that there is not much more to this gent's arguments than came out in the CS Monitor article.

</comment></comment></comment><comment><USER8> They keep building lots of unused housing and buildings. This would be a bubble in a western country, but I'm not so sure in China. Because they have 1.3 billion people, and the majority live in the countryside and are not even allowed to move to the cities yet even though they want to.

</comment><comment><USER9> Totally unrelated, but by eye was drawn to this on the page [http://www.csmonitor.com/CSM-Photo-Galleries/Photos-of- the-D...](http://www.csmonitor.com/CSM-Photo-Galleries/Photos-of-the- Day/2010/Photos-of-the-Day-03-16)

</comment><comment><USER10> Persistent bears will eventually be right, given long enough time, to call out the bubbles. A broken clock is right on time twice a day. Many bears shorting the bubble leading upto the 2005/2006 crash had lost their shirts.

</comment><comment><USER11> The word in Shanghai circles has been good times through the 2010 expo; uncertainty thereafter.

</comment><comment><USER12> So to hedge I should buy Chinese yuan? Or better, short the U.S. dollar?

<comment><USER13> How does one buy yuan?

<comment><USER12> Any large bank will exchange dollars for yuan.

</comment></comment></comment><comment><USER14> Not a statement on anything, just found this interesting from article:

<http://en.wikipedia.org/wiki/New_South_China_Mall>

99% empty mall, Western Fastfood companies are only draws.

</comment><comment><USER15> I am interesting in the correlation between the barrage of "China is melting" stories recently and the recent article on how a large percentage of news stories are given to the agencies by corporations/special interest groups (can't find the link). As new agencies tend to parrot each other it probably wouldn't be that expensive to start something like this.</comment>


Health information exchange vendor went belly up - <AUTHOR> http://www.courthousenews.com/2016/04/06/medical-records.htm <comment><AUTHOR> Sandlot Solutions has ceased operations. They were down to a skeleton crew as of last week, looking for last-minute funding to maintain core operations, but I was told that the board had already voted to close down if nothing came through as of Friday.</comment>


Stolen discussions - <AUTHOR>

In many HN submissions, the top voted comments are remotely related to the primary or secondary topics discussed in the story - and I feel like a nice discussion opportunity is stolen for an irrelevant or niche or superficial or competitor discussion. This situation disturbs me most of the time, but I'm also trying to find counter-arguments.  What do you think? <comment><USER2> I have an idea for a horizontal forum to solve this very problem. Soomeday I will work a little more on it. But the idea is that you have horizontal rows formed by every new comment direct to the post. And the subsequent comments of the thread are in this row.

This way it is easier to skip to the next comment thread. One thing you lose is the indentation that allows subthread on each thread, but I don't think it is a relevant loss.

And the ordening of the rows a mix of chronology and upvotes.

</comment><comment><USER3> I think it's a good emergent quality of varied points of view, that we don't always like or are interested in every post, or even appreciate the flow the post's comments are flowing.

I don't discount your observation and critique. But I would love to see a chart of primary, secondary, and tertiary points by upvotes and position in thread. Maybe even indexed by subject matter (social, programming, world news, etc...)

</comment><comment><USER4> Good comments extend the content. Good magazine advertising does the same thing.</comment>


Show HN: We built a bot to welcome new team members on slack - <AUTHOR> https://greetbot.io <comment><AUTHOR> We would love to hear from the HackerNews community. Positive and Negative.

Have you added it to slack? If so, what did you think? If not, why not and what would you change before you use it?

</comment><comment><USER2> Ok, you asked for negative: I don't think the world or any organization needs more impersonal words being automatically shouted to people who never asked for them. This is basically spam for Slack.

<comment> alch- Thanks for the feedback! Our idea is to help newbies get in touch with the right people to help them along, not just automatically shout impersonal words ;-) But clearly that still needs work. May I ask, did you install it or only look at the site? Thanks again!

<comment><USER2> Only look at the site.

I don't have a team to use it with, I also don't like Slack very much, so my feedback is probably worthless.

</comment></comment></comment><comment><USER3> This seems very impersonal and I don't think it will help in terms of team building.

<comment><AUTHOR> Thank you for looking at GreetBot.

I have a couple of questions.

Would you use it if it was more personal? What would you change to make it more personal? Would you use a tool for team building on Slack?</comment></comment>


Recording Tom Waits (2004) - <AUTHOR> https://www.soundonsound.com/people/bones-howe-tom-waits#para4 <comment><USER2> _" He told me he realised one night that as he was writing a song, he found himself asking 'If I write this, will Bones like it?' I said to him that we were getting to be kind of like an old married couple. I said I don't want to be the reason that an artist can't create. It was time for him to find another producer. We shook hands and that was it. It was a great ride."_

That's really interesting. I've always wondered about long-term creative/prdouction relationships, like Radiohead and Nigel Godrich, U2 and Steve Lillywhite, and some film directors who work with the same crews for decade after decade. Yes, you have that trust and magic and consistency, but can it hold the artist back in some ways?

</comment><comment><USER3> Tom Waits has such a unique guttural sound, I can't get enough of it. Daniel Durchholz said of his voice: "it was soaked in a vat of bourbon, left hanging in the smokehouse for a few months, and then taken outside and run over with a car".

[https://www.youtube.com/watch?v=qZS-B1Afc1c](https://www.youtube.com/watch?v=qZS-B1Afc1c)

<comment><USER4> I had forgotten that one. Here's another that shows some of the complexity of his voice and melody-making: [https://www.youtube.com/watch?v=0Ow45kTJqhg](https://www.youtube.com/watch?v=0Ow45kTJqhg)

</comment></comment><comment><USER5> The story of Tom Waits before Kathleen. Post Kathleen Tom Waits became the alternative music darling. His entire oeuvre deserves a serious listen but I recommend starting with Rain Dogs. And don't hesitate to watch Buster Scruggs. Tom Waits is a treasure.</comment>


Traffic Is Fake, Audience Numbers Are Garbage, Nobody Knows How Many See What - <AUTHOR> https://www.techdirt.com/articles/20160915/18183535533/traffic-is-fake-audience-numbers-are-garbage-nobody-knows-how-many-people-see-anything.shtml <comment><USER2> There are also a huge number of people using as blockers which actively block many of the tools people use to calculate users.

Furthermore these ad networks charges are based on this "traffic" with some vague and highly opaque promises that the bot traffic is filtered out.

Makes you wonder how much money is wasted on bot traffic.

</comment><comment><USER3> _Could they even be off by a factor of 10?_

I used to work in Data Science. I definitely agree with this sentiment. Sometimes we did statistical calculations of 'confidence'. Personally, I rarely felt confident, due in part to my constant OCD / skepticism. Question for people who know statistics better than I do: what does accuracy mean when there isn't a known "true" / standard value? What's the precision of a measurement when things are an order of magnitude off?

The article mainly talks about attribution. Another possibility is for some non-trivial portion of data to be systematically missing altogether. Data which isn't a randomly distributed sample, but a particular characteristic.

 _but all these numbers are actually good for (maybe) is relative comparisons_

I also agree with this. I guess it's okay for metrics to be wrong? As long as all the metrics are equally wrong in perfect proportion? This is why I also like to track the proportion between metrics, as well, as an internal consistency check. My mathematical intuition is that if the metric in question is a monotically increasing (growth) / decreasing metric over time, there will be a interval of time which this relative proportion is useful, after which the metrics, growing at different rates, will diverge to incoherence. Of course, models are not perfect representations of the world, and merely reductions to the key components. To give a concrete example of a model where things look good in some narrow domain, but breaks down. I wrote a physics wave propagation simulation. Instead of actually implementing the Wave Equation which is too much math for me, I used Hooke's law as an "approximation" if you can call it that. It's a good enough visual approximation, but there will is a critical value at which the system implodes or some fuzzier value at which things no longer look "unnatural" to say the least. Then again, Newtonian physics breaks down after a while too.

Also, when the model IS outputting the right answers, it could be for the wrong reasons. Companies will spend money on a particular thing, which they correlate and assume causes growth. For example, a particular marketing campaign. It could just be coincidence / fluke. Does Descartes' evil demon like trolling analysts?

I'm also a self-proclaimed minimalist: materialistic, and beyond. I'm curious what's people's experience with "hoarding" metrics? Given how hard it is to have accurate metrics, I feel reporting should be reduced to a small set of metrics one can be confident about, rather than a large set of metrics, none of which one can feel confident about. If I ever work on my own startup, that's how I'd run things, or so I hope. Maybe businesses gets pressured, to feel productive, to build confidence with employees, or by their investors to crank out metrics? I'd love to hear your stories there.

The article talks about having no idea what we're talking about. Sometimes we have no idea what we mean, ie: Semantics. A metric which we describe qualitatively in English can drastically differ in value based on how we formulate a query / computation. Maybe basic English sentences are not Turing complete, even. This notion doesn't really make sense though, because the issue of Semantics is also about communicating the idea between two people, and each person's mapping of a English sentence to a computation is a somewhat abstract idea. Anyways, either the semantics of the query doesn't reflect our qualitative definition of the metric, or querying the dataset is not a "closed-path", meaning one or more of the paths consists of wrong or inaccurate data. In which case, the solution is to be explicit about how a particular is computed, rather than WHAT we're desperately thinking we're getting at. Actually, it was when I first wrote two different queries to calculate the same metric, and having the numbers differ on an order of magnitude that I realized what we call confidence borders on quantified faith.</comment>


Negotiating in Vietnam is a strange, strange thing - <AUTHOR> http://www.sebastianmarshall.com/?p=234

<comment><USER2> My favorite memory of shopping in Vietnam (this was 25 years ago) was the shopkeeper writing down the price on a pad and handing you the pen and pad expecting a counter offer. You usually ended up half way between the two values.

That experience changed once we started speaking enough Vietnamese, and the first quoted price also changed (went down, especially for my mother)

</comment><comment><USER3> Or... you can go to Laos, Cambodia or Thailand. Much better experience and much nicer people

<comment><USER4> Hmm, when it comes to scams or overcharging you, Thailand is not much better than Vietnam. I remember asking 5 taxis in a row in Bangkok in some places before I could get a taxi that would agree to use the meter instead of ripping me off with foreigner prices.</comment></comment>


Starting vs. Building a Company - <AUTHOR> http://daslee.me/starting-v-building-a-company

<comment><USER2> Durable companies are one thing.

There's also the art form of catching some wave and building a company designed to be flipped in a few years' time. After that, the company (now division) in question invariably crashes and burns and the founders blame the whole fiasco on the acquirer. Happens...

</comment><comment><USER3> I think the key dichotomy here is between creating a successful _product_ at the core of a company and creating a successful _system_ that is able to repeatedly generate, select, and distribute products that fill market needs. Disney, 3M, and Apple are all great examples of "blockbuster factories" that are able to repeatedly innovate into the next field of play.

<comment><USER4> great point. better said than my articulation of continuing to innovate through tech cycles.

<comment><USER3> Thanks! Great piece, by the way — my goal is to be a successful starter _and_ builder. And I agree that many seem to focus only on the former.

</comment></comment></comment><comment><USER5> To be perfectly honest, there are a few companies that exist because the build and sell something fairly remarkable as a product or a service, but there are literally millions of companies that survive off of the inefficiencies in existing markets. Many/most businesses operate off of a form of arbitrage, not unique product creation.

For example, look at retail, it exists on the arbitrage opportunity of buying things in bulk and transporting them to local markets to sell them. However, if transportation costs were cheaper or people did a better job of planning ahead, most retail need not exist.

Even online retail has the same problem, at a certain level Amazon woudln't need to exist if manufacturers could sell and deliver direct to you.

My point is that most businesses don't _need_ to exist, but there is opportunity in both short and long term arbitrage that isn't durable or sustainable, but many times can be quite profitable.

<comment><USER6> What you call "arbitrage", many call distribution. And it can get pretty complicated.

Take the simplistic example of a local grocery store. In no particular order, the store must:

\- Determine what to carry

\- Determine how much to buy, taking into account seasonal variances, local tastes and preferences (is there a sporting game in town? Buy more beer)

\- Arrange for financing to cover everything; a good-sized grocery store has millions of dollars of inventory sitting on the shelves

\- Ensure the hot things stay hot, and the cold things cold

\- Loss prevention: reduce theft, breakage, spillage, spoilage as much as possible

\- Handle vast amounts of cash, exposing the store to all manner of theft (by employees), counterfeiting, fraud, and robbery

All I'm saying is, don't dismiss something because it isn't "unique product creation".

<comment><USER5> Sure, I didn't mean to imply that those aren't real businesses. I just meant to imply that in the "startup world", a lot of these businesses are totally overlooked because they aren't doing the minimum viable product lean startup thing.

I don't dismiss those businesses at all, I think there are a lot of great opportunities in arbitrage based businesses, but a lot of startups ignore the opportunities that aren't the next big mobile/social thing.</comment></comment></comment>


Ask HN: Bootstrapped startup founders, I need your ideas and advice - <AUTHOR>

I'm planning to start a new blog aimed specifically at indie developers bootstrapping their businesses. I will share the lessons I have learnt from my ventures, with details and specific action points like how to get your first 100 customers, how to market within a niche, how to test pricing, and similar topics.<p>But, before I start, I turn to you to ask what your most pressing problems are. What do you wish to learn more about and get better at? <comment><USER2> I think the hardest is the first impulse. To convert from user 0 to user 10 is not so hard (you can invite friends, etc.), but when all your friends are registered, what? How to reach unknown people out there, I think that's the hardest part. People interested, not so publish on Hacker News or something like that where a lot of people see, but there are not a lot of conversions.

<comment><USER3> I agree totally with you, finding the first users is the critical point on every startup when you finally find out if your idea is worthwhile or not

</comment></comment><comment><USER4> My problem: the idea. I know the steps to get there (talk to people, find their pain points, test whether they would actually pay for something, etc.), but it's still my biggest hurdle.

</comment><comment><USER5> This is discussed online ad infinitum but getting funding, navigating legal issues (incorporating, hiring, etc), building critical mass.

</comment><comment><USER6> I would love to learn/develop a true strategy for validating ideas. To gather insight before I go off and build an MVP.</comment>


Job Enrichment: how to make a job un-boring - <AUTHOR> http://edweb.sdsu.edu/people/ARossett/pie/Interventions/jobdesign_1.htm

<comment><AUTHOR> Skill variety, task identity, task significance, autonomy, feedback -- these job characteristics sound a lot like what an entrepreneur craves.

What if they key to enriching a normal job is to make it more entrepreneurial?</comment>


RadiumOne's Board Is Now Deciding Whether to Dump the CEO - <AUTHOR> http://recode.net/2014/04/26/radiumones-all-male-board-is-now-deciding-whether-to-dump-the-ceo-over-domestic-violence-conviction/

<comment><USER2> Am I in bizzaro world? Are we really trying to excuse this guy via the excuse of separating personal life and his responsibility as a CEO? This is a guy who has physically harmed someone else. And there are people who question whether or not the board should let him go?

This is not even a case of "allegedly". This is clear cut and the only reason he got away with it was because the judge threw out the tape. It seemed the cops were afraid he'd erase the tape so they seized it on that assumption.

Regardless he still plead guilty. As an employee would you really want to work for him? What about as a potential hire? This guy is toxic and should be thrown out

</comment><comment><USER3> So is the consensus that this guy actually committed all counts of the allegations or is this article just really biased.

<comment><USER4> Good question. I haven't done any reading on this myself, I only know what my wife has been telling me, but my impression is that the video tape does exist and does show exactly what it's alleged to show, the only problem is it was thrown out (on a 4th amendment violation). Without the video tape, they couldn't get the felony convictions. But assuming the tape shows what is claimed, he seems pretty guilty.

<comment><USER5> He plead guilty to the charges.

<comment><USER6> He pled guilty to the two misdemeanor charges; the 43 felony charges he pled not guilty to. The document is embedded there in the link.

</comment></comment></comment></comment><comment><USER7> >all-male board

Sorry, why is this constantly re-iterated?

Does them being men mean they'll be less likely to want to can a (supposedly) abusive monster/someone whose position as CEO would bring them to popular ruin?

Edit: Spacing.

<comment><USER8> Yes, it probably does.

<comment><USER9> How deep did you go to pull that out of your ass?

<comment><USER8> How long have you been a member of RadiumOne's board of directors?

<comment><USER9> The question wasn't whether it was because they were on the board of directors for RadioOne, it was if it was because they were men.

</comment></comment></comment></comment></comment><comment><USER10> > Should a board remove a CEO who is convicted of domestic violence and > battery? The answer seems obvious: Yes.

Aggressive violence is worthy of punishment, but a question that seems persistent recently is whether a person's personal failings should be met with professional consequences. If so, it should also be considered to which positions and for what period of time those consequences should be applied.

Either way, the answer to that question hardly seems obvious.

<comment><USER11> Domestic battery w/ 117 blows over 30 minutes, covering her mouth and threatening to kill her. I would have an extremely hard time working with someone who recently did that and especially does not appear overly repentant & rehabilitated (see deleted twitter comments).

The board should have removed him as soon as substantial allegations arose- this is not conducive to a respectful workplace.

</comment></comment><comment><USER12> I find the recent trend about total inability to separate a persons' personal life from his professional disturbing. So for me the answer to the question should he be removed from his position is far from obvious yes.

If you feel mad about him getting away easy, ask for better training of cops to respect a person rights (a fourth amendment violation is far from technicality), suspension of the plea deals for DA or fix the system. By imposing your own extrajudical punishments you are undermining the court system as a whole.

They payment for a person's crime should end with the sentence. Even for a despicable deed like that.

<comment><USER13> There is a clear line drawn around criminal behavior and employment. It's considered disqualifying for most jobs to be convicted of a crime - and if he is convicted, he should be removed.

Should a CEO should be held to a lower standard than a janitor? Please. It's not enough for the average pay of the guy on top to be many multiples of the average, we now allow him to beat the sh*t out of people as well?

The Eich situation was quite different. His political donation was a feeble expression of his right of free speech. No laws broken. He just dared to be out of step with elite opinion.

Perhaps pg said it best:

"What scares me is that there are moral fashions too. They're just as arbitrary, and just as invisible to most people. But they're much more dangerous. [...] Violating moral fashions can get you fired, ostracized, imprisoned, or even killed."

[http://www.paulgraham.com/say.html](http://www.paulgraham.com/say.html)

<comment><USER14> > It's considered disqualifying for most jobs to be convicted of a crime

This is not even remotely true.</comment></comment></comment>


A straight talk about btrfs - <AUTHOR> https://www.suse.com/communities/blog/butter-bei-die-fische/ <comment><USER2> A data-point of one, and I only have a few TB spread over a handful of disks, but I lost an entire 1TB btrfs volume recently because of a single disk sector gone bad (of course, I have backups, but it's a pain to restore 1TB, not to mention racking of the nerves (will the backup drive fail with sudden heavy use?)

It's the only FS I've ever been unable to recover data from, at all, (I've had quite a few disks with errors before going back 25 years), and so it's no longer on my list of filesystems-I-trust.

<comment><USER3> Serious question: Why would anyone today use BTRFS, given that the battle- proof ZFS has finnally been ported to Linux for quite some time?

<comment><USER4> > Why would anyone today use BTRFS, given that the battle-proof ZFS has > finnally been ported to Linux for quite some time?

It's only been available out of the box in a simple-to-use and supported fashion in 1 Distro for barely 1 year.

You can hardly say it's been widely available, nor for a "quite some time".

<comment><USER5> ZFS on Linux has official support for Arch, Debian, Fedora, Gentu, OpenSUSE, RHEL &CentOS and Ubuntu.

<comment><AUTHOR> It has "official support" from the ZoL folks. And yes, openSUSE has ZFS packages in OBS. But we sure as hell don't ship them by default, or in our official repos. The same applies for Arch, Debian, Fedora, Gentoo, RHEL and CentOS.

Ubuntu is the only distribution that official supports ZoL, and actually ships it in it's official repositories (and by default). What that means is that Canonical is effectively saying "we trust there's no legal reason why we cannot do this." No other distribution has made that claim.

EDIT: Actually NixOS also supports it, but the point stands.

<comment><USER6> Well, also NixOS.

</comment></comment></comment></comment></comment></comment><comment><USER7> _If Brazil, one of the world biggest producers of beef, would announce to stop producing fish: would you wonder, whether Peru, one of the world biggest producers of fish, would stop producing fish?_

I find this quite weak argumentation coming from SUSE. Novell/SUSE was also (by far) the largest contributor to AppArmor at some point. And SUSE used it as the MAC framework in their consumer and enterprise distributions. Then seemingly out of nothing they fired the AppArmor team.

<comment><USER8> Oh? What are they using now then? SELinux?

<comment><USER9> _AppArmor is configured to run by default on any fresh installation of SUSE Linux Enterprise Server._ [https://www.suse.com/documentation/sles11/book_security/data...](https://www.suse.com/documentation/sles11/book_security/data/sec_aaintro_enable.html)

All the drama was back in 2007. [https://web.archive.org/web/20160410165126/http://www.cnet.c...](https://web.archive.org/web/20160410165126/http://www.cnet.com/news/novell- lays-off-apparmor-programmers/) Looks like it blew over by 2008 [https://news.opensuse.org/2008/08/20/opensuse-to-add- selinux...](https://news.opensuse.org/2008/08/20/opensuse-to-add-selinux- basic-enablement-in-111/)

</comment></comment></comment><comment><USER10> For those who wonder who deprecated it, Red Hat did in the release notes for 7.4.

Search for brtfs in [https://access.redhat.com/documentation/en- US/Red_Hat_Enterp...](https://access.redhat.com/documentation/en- US/Red_Hat_Enterprise_Linux/7/html/7.4_Release_Notes/chap- Red_Hat_Enterprise_Linux-7.4_Release_Notes-Deprecated_Functionality.html) for details.

<comment><USER11> As has been discussed in other threads, RHEL's kernels are ancient compared to mainline and so they probably decided it's just too much work to continually backport btrfs changes onto increasingly dated kernels. The sky is not (necessarily) falling.

<comment><USER7> But if they thought that btrfs was the future, they would definitely have put in the manpower to maintain and backport btrfs. Red Hat probably believes that XFS + LVM et al. can provide the necessary functionality for enterprise setups on a more reliable basis.

<comment><USER12> They were never heavily invested in btrfs and they simply already employ a lot of XFS developers. I also don't think it's that easy to put more manpower into it. People with expertise in such such a rather complex niche field don't grow on trees.

<comment><USER13> But do they grow on btrees?

Filesystem joke, hilarious I know

</comment></comment></comment></comment></comment><comment><USER14> I'm really confused by the choice of development process for BTRFS. First they write huge amounts of experimental/buggy code and then spend years trying to fix it. Reliability was obviously not the primary goal and I doubt they will be able to retrofit it.

</comment><comment><USER15> This is a bad move. More than ever we need Linux standards and this goes in the opposite direction. It would be OK for SUSE to support btrfs as a first class choice of filesystem but the extfs family should be the standard one.

And ZFS works just fine on Linux. If people want to use it, then the distros should not put roadblocks in their way and that means, ZFS should also be supported as a first class choice for servers.

Note that "support" is different from licensing and from "included in our install repo". It is OK to have different licensing for things like this and to install it from a non-distro repo. Look at PostgreSQL for an example of how you can install a mission critical tool from a distro-compatible repo that is run by the upstream project, in this case, PostgreSQL.

But even though it comes from a different repo, it should be "supported" by the distro to the extent that they make a best effort to help people resolve problems. It doesn't mean that you need to be experts in every nuance of the tool and the best way to do that is to maintain a good working relationship with these upstream projects.

Something like ZFS or PostgreSQL are mission critical tools that use Linux as the interface to the hardware, My comments do not apply to any random app or utility that someone wrote for Linux. Perhaps btrfs belongs in this class but I personally don't know since I have not used it.

<comment><USER16> Linux has lately gotten a lot of bad standards.

<comment> iso-8859-1 Such as?

<comment><USER16> Most of the things by freedesktop.org in the last.. idk 5-10 years. Console- kit/logind, AppData, dbus being used for the lower parts of user-space, and probably many more that i don't recall now. Oh, and pulseaudio.

EDIT: How could i forget polkit.

</comment></comment></comment></comment><comment><USER17> Recent Redhat decision may also be related to their investment in Storage products Ceph (~175 million in 2014) and GlusterFS (~125million in 2011) not just about stability of btrfs.

As someone who previously experienced with distributed storage like emc-Isilon and also fuse-based glusterfs, btrfs has huge potential for enterprise storage. It does also need more effort on testing front at this moment. hoping that soon btrfs will become default fs for most Linux distros.

<comment><USER18> I read somewhere (probably on HN) that it could be related to their acquisition of Permabit, a company which seems to be producing Linux software for deduplication, compression and thin-provisionning. This seems more in-line with what btrfs has to offer.

</comment></comment><comment><USER19> When a CEO/CTO uses the words "straight talk" I prepare for a copious load of meaningless waffling. Was not disappointed!

<comment><USER20> huh. i found it to be coherent and not-particularly-heavy on techno- doublespeak.

while it wasn't particularly edgy/straight, it certainly wasn't "meaningless waffling".

i got the impression the title came from wanting to use the german idiomatic expression for "straight talk" in order to work in the butter-cow pun.

</comment></comment><comment><USER21> I've taken a long look at COW filesystems in these past days as part of me wanting to set up a new workstation, and it appears that while btrfs is not a viable long-term solution for its quality issues and lack of development, ZFS does not have the pretense of being a filesystem for the general usecase, as exemplified by the lack of offline deduplication, defragmentation, the possibility to easily change disk configurations, and much more. Maybe we should consider accelerating the development of bcachefs as the future of reliable and feature-rich filesystems on Linux, which appears both more modern and holistic, but still has quite some ways to go. A new filesystem is necessary because many things we should demand from them are not modularly composable without massive disadvantages. Implementing compression as a layer, for example, demands basically creating another filesystem to manage the space, with great overhead in all dimensions. Similar things go for the consistency guarantees provided by COW or the deduplication and snapshotting that depends on it.

</comment><comment><USER22> 2 days ago I shutdown my laptop and all was working out great at that point. Now yesterday I turned back on to get some work done and couldn't pass maintenance mode because my home partition got corrupted somehow. Took me all day literally to get it working. I have since changed that partition back to ext4 leaving only / as btrfs

</comment><comment><USER23> I use BTRFS for non critical data, like scratch data and second backup archives. This is because I can stretch it out over many old harddrives I have laying around. The memory footprint is also very low. And it comes with compression!

But for everything else, I have rammed up, manned up, and use ZFS.

</comment><comment><USER24> Is there any reason why Oracle contributes so much to Btrfs while maintaining ZFS? Or am I mistaken in Oracle's relationships with ZFS

<comment><USER25> Oracle sells Oracle Linux, a RedHat clone. ZFS on Linux (ZoL) isn't controlled by Oracle, it is a fork of OpenSolaris version of ZFS. The ZFS sold by Oracle on Solaris isn't the same product and doesn't support Linux. Oracle doesn't want to support it on Linux because it would fragment one of the remaining cash cow they got from Sun. And anyway, they probably can't support ZoL even if they wanted to without putting themselves into self induced legal gray water. Apparently, they intend to move Solaris into a rolling model like Windows 10, but focused on legacy. They can sell ZFS there without affecting their Linux operations. There is also a rumor of a deal with NetApp not to support ZFS on Linux. All combined, BTRFS is a better suited tech for them to support.

<comment><USER26> I was wondering, how does Illumos fit into all this? Is their ZFS the Oracle- controlled one?

<comment><AUTHOR> illumos is the repo of record for OpenZFS[1], which is the community fork of OpenSolaris' ZFS (which is now proprietary). Most of the really cool new features are in OpenZFS because it has far more developer involvement (from FreeBSD, illumos, etc).

[1]: [http://open-zfs.org/wiki/Main_Page](http://open-zfs.org/wiki/Main_Page)

</comment></comment></comment></comment><comment><USER27> That's gotta be the weasel-wordiest straight talk I've seen in a wee while.

Here's a fact: the upstream's official statement is that RAID 1 isn't production-ready.

<comment><USER28> > " _Here 's a fact: the upstream's official statement is that RAID 1 isn't > production-ready._"

That doesn't seem to match anything I've seen. The btrfs status page classifies RAID1 and RAID10 features as "mostly OK". The one and only documented caveat is that when a disk in a RAID1 fails, you should mount the filesystem as read-only until you are ready to fix the problem by either replacing the failed disk or converting to a non-RAID profile. There's a real bug underlying this limitation, but the only way to encounter this bug is to be quite cavalier about how you handle a degraded array, by doing something that you shouldn't _expect_ to be safe.

<comment><USER29> Mostly OK != production ready.

A degraded array should have no substantially greater risk of failure than the single disks the vast majority of people rely on daily. I can think of one obvious reason one might mount the degraded array simply to copy data from it to a different arrangement. Another reason is in a non enterprise use case a desktop users might not instantly have a disk available and might mistakenly believe that this is no more risky than having only one disk in the first place.

This is ridiculously flaky for something that is supposed to be years in development with backing from major companies.

This confirms my feeling that btrfs belongs in the waste basket.

<comment><USER28> > Mostly OK != production ready.

Don't nitpick about what a two-word summary implies when there's only one underlying bug at issue. Just address the bug itself. "Production ready" never means 100% bug-free.

> A degraded array should have no substantially greater risk of failure than > the single disks the vast majority of people rely on daily.

If you are comfortable dropping from the RAID1 profile to a non-RAID profile, btrfs requires you to explicitly make this conversion; there's no safe way to make it automatic. Forcing the filesystem to accept writes while it's still in RAID1 mode but is incapable of providing RAID1 data integrity is something that you should expect to cause problems.

> I can think of one obvious reason one might mount the degraded array simply > to copy data from it to a different arrangement.

You can mount read-only as many times as you want if you're going to copy the remaining data to a different filesystem. If you want to do an in-place recovery, the current limitation is only that you shouldn't mount the degraded array as writable until you're ready to make it not degraded anymore.

</comment></comment></comment></comment><comment><USER30> TL;DR - Don't be dissuaded by marketing, here's some more marketing.</comment>


"Java's Forgotten Forebear" - <AUTHOR> http://spectrum.ieee.org/computing/software/javas-forgotten-forbear?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+IeeeSpectrum+%28IEEE+Spectrum%29

<comment><USER2> As Goethe once wrote, "Everything has been thought of once. The problem is to think of it again."</comment>


Show HN: DataCabinet, Website to Maintain Jupyter Notebooks in the Cloud - <AUTHOR> http://datacabinet.systems
DataCabinet is a website to maintain conda environments directly on the cloud and access these environments through Jupyter notebooks. It also offers other useful features like sharing and authentication/authorization.
Find detailed usage documentation: https://datacabinet.github.io/
Your feedback would be invaluable as we stabilize and add new features to the product. Here are some access codes to activate the beta: 'y2OdwyOmSb', 'RgcXyBdWA9', 'HnHoCMmbHb', '44cdEazOFl', 'btyqZfxcEz', 'kSm7K8bcsf', 'wFrgedzY8D', 'OfbmB9CqIC', 'qZFbrTqTnM', 'DsDo2dsyU7', 'nGHeiW1aTG', '2z83eGo9t5', 'TXDYzUSOkR', 'qGJElb1ulm', 'f1jORN7Hfz', 'kr7PnQz6op', 'mBeOBrX97D', 'NY8cCWIsT2', '3e5qj4qQJI', 'SsmL2231Qh', 'Yrel78TGB9', 'O3LLe5jTxj', 'rTIih3HxDU', 'G9AOXOeUsL', 'b8GyW2AiRf', 'Wf5baiO5MU', '2XjDyfnFbF', 'jAuNjtK1io', 'X1UwmhKx9i', 'GFtBN2CjGo', 'rwaGLh63Cb', 'gsgublZnkz', 'GPO5dMzuJ5', 'tHbiuG7pYe', 'nKuZCL8pYn', 'hAKjwy1tnb' . If these run out, please sign up at http://datacabinet.info and we will send you more access codes if needed.
If you face any trouble, please write to us at email@example.com or join our slack channel: https://slackpass.io/datacabinet . <comment><USER2> The first field says 'your name' but doesn't accept a name which contains space. Is that supposed to be user name? If yes, the text box should say that. Other than that, it worked great.

</comment><comment><USER3> Neat product. Looks like it needs a little polishing on the UI, otherwise looking forward to seeing what's coming next!</comment>


Ask HN: Staying motivated with school when I'm already getting job offers - <AUTHOR> So heres my problem: I'm finding it difficult to stay engaged with school when I'm not encountering new material I haven't already studied in my free time.
I started learning to code when I was 11.  I know my way around C++ and python, and Objective C (although I'm really digging the Swift thing now), Java, SQL, HTML, Javascript, etc.  I have several apps on the app store and google play store. I built my own portfolio site.  I run my own web server, vpn, and mail server.  6 years ago I decide 3D modeling was cool, so I devoted a significant amount of time to learning the ins and outs of blender.  I build my own character rigs, created environments, 3D print stuff, etc.  That in turn got me interested in graphic design.  I actually had a minor in design before I graduated from high school by taking early college classes.  I've used just about every flavor of linux I could find and I feel at home with BASH.  I love vim.
I'm currently in the freshmen year of my undergraduate CS degree, and its boring the heck out of me.  I want to be teaching myself the basics of graphics programming or neural processing, but instead I'm stuck copying android code out of a textbook.  My grades have started to suffer simply because I dread the thought of sitting for hours competing mindless homework.
I had a really good internship over the summer where I was designing and implementing UIs for android apps.  I'm currently working there part time, and my boss is all set to offer me a full time position.
All of that to ask, how do I find the motivation to get through school? <comment><USER2> First year CS can be boring, the more interesting classes come later. I highly recommend sticking with it, I was in a similar place freshman year and really enjoyed the later years of the degrees.

I also recommend talking to the TA's and professors to see if you can get involved in any of their research or projects. That's something I was able to do junior year, and if I'd known about it I probably could've gotten involved much sooner.

<comment><AUTHOR> I would absolutely love to get involved with a research project. Unfortunately the CS program at school is relatively new and I'm pretty sure there nothing like that going on. I know most of the TAs and they have a habit of coming to me for help with their coding homework. So that's a bit of a dead end. I'm sure you're right about the later classes being more engaging, so at least I have that to look forward to.

</comment></comment><comment><USER3> Maybe a CS degree isn't the right choice. Maybe it's design, art, math, music, journalism, anthropology?

Maybe CS is the right choice, and instead of working part time on Android apps, reading Knuth or learning Haskell or hacking an Arduino is a better way to supplement the classes?

Is designing and implementing UI's for Android apps your long term ambition?

My impression is that developments at interesting edges of graphics programming and neural nets depend on mathematical and algorithmic competence that comes from deep understanding. School is probably the most accessible route to experts, structure, and a socially acceptable excuse to invest time in those topics.

The second route is working at a place that values people's interests in those things.

Good luck.

</comment><comment><USER4> I'd say a college degree that is somewhat related to what you like doing is a good to have. Spend the remaining of your time doing whatever it is that you want to do.

</comment><comment><USER5> What would you like to do in the long run? There are some things that doing well in school would help a ton on. Other things, not so much.</comment>


Ask HN: Submitting HN comments - <AUTHOR> Hi,
I've just submitted https://news.ycombinator.com/item?id=9872640 as a test.
I wanted to explain in the comments that I believe that older, longer comments with lots of technical content might be a good discussion starter, and that I wouldn't do it again if the submission was flagged to death, but it looks like I can't comment on a ycombinator.com submission.
So let me ask you here: Do you think such submissions are acceptable? <comment><USER2> It wasn't flagged, it looks like the domain news.ycombinator.com is on a blacklist for submission, most likely because users keep submitting the [https://news.ycombinator.com/bookmarklet.html](https://news.ycombinator.com/bookmarklet.html) Maybe also to prevent submitting [https://news.ycombinator.com/vote?id=..](https://news.ycombinator.com/vote?id=..). or similar URLs which might execute on your behalf.

I think it's acceptable, but confusing to users when they click on a headline, end up in an old comment thread and wonder why they can't comment (I think threads are closed after 14 days, not sure).

</comment><comment><USER3> I suspect that such links are screened by the software because the potential for technical and social abuse outweighs potential technical and social benefit.

To me, if a comment is interesting enough to be brought back from the dead, it's interesting enough for someone to write a blog post about and submit that...and if it isn't interesting enough to write a blog post about, then maybe it wasn't really _that_ interesting to begin with.

Good luck.</comment>


The privacy of the TLS 1.3 protocol [pdf] - <AUTHOR> https://eprint.iacr.org/2019/749.pdf <comment><USER2> Oof. This is an important contribution about the handshake and resumption protocols, but the abstract is badly misquotable. I worry this will lead to problems as it's reported elsewhere.

TLS 1.3 doesn't encrypt the SNI, doesn't encrypt the destination IP address, and doesn't mask the size or ordering of packets. In practice, TLS 1.3 protects secrecy of the bits you send—but not privacy of to whom or how much.

As I wrote five years ago when TLS 1.3 was getting started, [https://weblog.evenmere.org/posts/2014-05-16-tls-is-not- for-...](https://weblog.evenmere.org/posts/2014-05-16-tls-is-not-for- privacy.html) , the privacy folks have needs misaligned with the prevalent technology.

<comment><USER3> When I saw the title of the paper I expected it would be about what the parent comment describes. Instead, they deliberately omit the case of SNI and state that this issue "deserves its own paper".

I think any serious consideration of the issue cannot proceed on the assumption that the SNI extension is a "must-have". It is optional. Users can prefer websites that do not use SNI. There are still plenty of TLS-protected websites not using CDNs and SNI.

CDNs often do not check the Host header against the SNI name.

For example, request a page from www.globalsign.com from host marketcircle.com.

       echo -e "GET /en/ HTTP/1.1\r\nHost: www.globalsign.com\r\nConnection: close\r\n\r\n"|openssl s_client -no_tls1 -no_tls1_1 -no_ssl2 -no_ssl3 -ign_eof -no_ticket -host marketcircle.com -port 443 -tlsextdebug -servername marketcircle.com -verify 9

<comment><USER2> This is a tricky question to turn off. It's rarely clear how to construct an attack with it, and it does allow a kind of privacy by telling your ISP & DNS providers one name, while asking for another.

</comment></comment></comment><comment><USER4> This paper is misleading IMO. The abstract says - "On the positive side, we prove that TLS 1.3 protects the privacy of its users at least against passive adversaries, contrary to TLS 1.2, and against more powerful ones."

But if you read the summary, it also says "both TLS 1.2 and TLS 1.3 session resumption present serious privacy flaws despite not using concrete authentication elements, such as certificates ... While [PSK-DHE] provides a measure of backward security, it does nothing to improve privacy."

TLS1.3 is awesome, but it's still a layer 4 transport scheme, and there are plenty of ways that a passive adversary can derive privacy sensitive information. I mean it's /trivial/ for a passive adversary to tell that you're visiting an embarrassing website ... to pick just one obvious example.

<comment><USER5> Right, and it's in the name, after all: Transport Layer _Security_. Security is not quite the same as privacy.

TLS was never meant as a way of guaranteeing privacy in a broad sense as far as I know, and this is the first time I'm seeing it described as such.

Now, one may argue that security is a needed component of privacy, but it's certainly not enough by itself.

</comment></comment><comment><USER6> > Another feature we omit is the Server Name Indication (SNI) extension, which > allows a single server to run TLS handshakes on behalf of multiple domains, > using multiple public keys.

I don't understand how you can seriously use TLS and privacy in the same headline whilst actively ignoring the mess that is SNI...

<comment><USER7> If you connect to a website behind a CDN hosting many websites, a passive observer can tell that you connected to the CDN, but has no idea which website you requested (let's pretend that they can't use a length fingerprinting attack). However, unless the CDN supports domain fronting, which most don't, you have to use SNI to tell the CDN which website you want so you can get the right cert. As SNI is unencrypted, a passive observer now knows what website you are talking to. Privacy defeated.

If you connect to a website not behind a CDN, you probably don't have to use SNI, but, the website is revealed by doing a simple reverse DNS query. Privacy defeated.

Unencrypted SNI doesn't hurt privacy when compared to the status quo. Encrypted SNI will boost privacy. But until then, TLS is basically the best you can do for privacy, outside of using some more exotic service.

<comment><USER3> "If you connect to a website not behind a CDN, you probably don't have to use SNI, but, the website is revealed by doing a simple reverse DNS query."

As an example, I tried a reverse DNS query for the IP address of matrixssl.org. All I got was a subdomain at gandi.net.

Reverse DNS was originally intended for troubleshooting. It is _not required_ for websites (cf. email) and not everyone bothers to set it up. That is one group of websites where we have to do more work to get the names that are using the remote IP address and figure out which one the user asked for.

In fact, DNS is _not required_ for a functional website. IP address of course works fine. That is another group of websites where we have to do additional work to figure out what is at the remote IP address. We do not know what the user sent in her HTTP headers.

By comparison, SNI makes the process of invading user privacy easy and reliable, less work. The user is _required_ to send a name, and to send that name in the clear.

<comment><USER8> >As an example, I tried a reverse DNS query for the IP address of matrixssl.org. All I got was a subdomain at gandi.net.

While the gp is wrong in saying that it's as simple as a reverse DNS lookup, his general idea is correct. It's trivial to crawl the internet to find all the ip -> domain mappings for all public domains. It's even easier if the attacker is an ISP because they can log DNS queries/responses.

<comment><USER3> If the parent comment is suggesting it is no easier with SNI, then I disagree. Not all domains are "public" and not all users send their DNS queries to ISPs or third party DNS providers. There are alternative sources for IP to domain mappings for TLS-enabled websites besides reverse DNS, crawling the entire internet is not necessary, but sniffing SNI is _easier and more reliable_ than relying on DNS.

</comment></comment></comment></comment></comment><comment><USER9> sad</comment>


Pwn2Own winner tells Apple, Microsoft to find their own bugs - <AUTHOR> http://www.computerworld.com/s/article/9174120/Pwn2Own_winner_tells_Apple_Microsoft_to_find_their_own_bugs

<comment><USER2> I've done some of work in the area. Most of the companies that use, or even require fuzzing in their software development procedures, have a certain problem: the same people who write the parsers write the fuzzers. When they write these fuzzers, they make some too-strong assumptions on the formats of the data involved.

Writing smarter fuzzers may be needed to fully exercise certain file formats, say where certain blocks of data need to match a CRC elsewhere. But smart fuzzers fail where the authors fail to account for edge conditions. Having both in your toolset is invaluable.

Regardless, it's sad for companies like Apple that they're not doing any of this.

<comment><USER3> Dumb fuzzers find things in Microsoft code all the time, and Microsoft spends huge on external teams to write fuzzers.

<comment><USER4> So what's your analysis of why the external teams are ineffective?

<comment><USER3> They're not.

<comment><USER4> OK, so Microsoft finds lots of bugs by this technique (according to you), but then this guy says that he finds still more bugs, with (according to him) pretty primitive methods. And then the guy says,

'"I found bugs, lots of bugs. That was both surprising and disappointing." And it also made him ask why vendors like Microsoft, Apple and Adobe, which have teams of security engineers and scores of machines running fuzzers looking for flaws, hadn't found these bugs long ago.'

So given your assertion that these teams are very effective at what they do, why do you think this guy is very easily (according to him) able to find additional bugs?

There's a mismatch between what you're saying and the gist of this article. I'm not saying you're wrong -- far from it. I'm looking to you for a resolution to the discrepancy.

<comment><USER5> This guy is in the security business. If you think your software is secure, he's out of work. If he creates the impression that he didn't even have to try that hard to find these vulnerabilities, then you get paranoid and want to hire him.

To be clear, I'm not saying the vulnerabilities weren't real, but to buy his story about them being "easy" to find, well...

<comment><USER3> I tend towards the "Charlie is just better than most of us" view of the world, too.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> "He went into the project figuring that he wouldn't find any vulnerabilities with the dumb fuzzer. "But I found bugs, lots of bugs. That was both surprising and disappointing." And it also made him ask why vendors like Microsoft, Apple and Adobe, which have teams of security engineers and scores of machines running fuzzers looking for flaws, hadn't found these bugs long ago."

Or, maybe the companies have already found those bugs and more, but focus their efforts on bugs that surface in the wild and don't spend resources on the others. If they fix all the bugs, then they spend money on some bugs that would never have surfaced. Just a guess.

<comment><USER3> Waiting to fix _bugs_ until they become an issue is smart, if a bit ruthless.

Waiting to fix _security flaws_ until they become public is negligent.

From firsthand experience with at least one of the companies implicated in the recent stories: they aren't sitting on things. What Charlie Miller is finding is news to them.

</comment></comment><comment><USER7> This is somewhat equivalent to WikiLeaks' release strategy: tell the organization that you have evidence of XYZ problem, but don't describe the exact nature and scope of the evidence, then pressure them to come clean and fix the problem themselves; hopefully this leads to more comprehensive "cleanup" efforts that have a larger positive long-term effect.

How relevant is the WikiLeaks strategy in the field of security?

<comment><USER3> It depends on the vendor. There are vendors for which the "announce and hold back" strategy will probably work: they're the ones who market based on security. It is a Big Deal if someone has an IIS remote, or a reliable Flash, or Apache/WebSphere.

We'll see how big a deal it is for Google and Apple. Marketing based on security means more than just talking about security on your web page. It means making a business out of people who buy based on product security. I like my Mac, and I like Apple, but I have no illusions about the resilience of OS X.

</comment></comment><comment><USER8> Anyone able to give more detail? Maybe not on Millers specifics but how does inserting random data into a program become an exploitable vulnerability?

<comment><USER9> <http://en.wikipedia.org/wiki/Fuzz_testing>

</comment></comment><comment><USER10> He sounds naive and his logic is quite the cliche. Surprised he didn't close it with a line from the hacker's manifesto.

I'm not sure what it is with some people acting like the smartest guy in the room while refusing to share their knowledge for the betterment of society. Entrepreneurs benefit tremendously from mentors and advice from those who've made it. I'd be surprised if he didn't learn a vast portion of his trade from the openness of information. I guess he feels empowered w/ his :15 minutes and this is how he leverages it? Weak^10.

+++the pxlpshr+++

<comment><USER11> I didn't get that sense from the article - he's not refusing to release the info for his own benefit, or to be a dick; he's ostensibly doing it because he feels like this just encourages the "we'll fix stuff when other people find it in the wild" mentality, which doesn't help make software more secure in the long run.

He wants software producers to actively try to break their software so that his ostensibly simplistic tools can't find wide open holes like this.

I'm sure some egotism rolls into it somewhere, but I don't think it's altogether a bad stance... you shouldn't be waiting for your users to tell you where your security holes are.

<comment><USER10> _you shouldn't be waiting for your users to tell you where your security holes are._

while I agree with that ideology, in reality you just can't assume that to be the case when you have multiple people touching the code, and features added regularly that may inadvertently introduce holes. what software has ever been 100% bullet proof?

Also, I think that statement largely contradicts the notion of 'release early, iterate often' considering it's grounded on the notion of integrating feedback and bugs reported by users. Are major corporations held at a different standard simply because they have more resources? Even with thousands of employees, it's still a glass box compared to the millions that will use it.</comment></comment></comment>


Twitter Lets You Target Millions of Users Who May Like the N-Word - <AUTHOR> http://www.thedailybeast.com/twitter-lets-you-target-millions-of-users-who-may-like-the-n-word <comment><USER2> Wow. Advertising companies work off of strings of text. Amazing.

Can companies create platforms anymore without having to police everyone using them?

Next up: Google allows people to search for the n word</comment>