Technology is making the world more unequal; only technology can fix this - <AUTHOR> https://www.theguardian.com/inequality/2017/may/31/technology-is-making-the-world-more-unequal-only-technology-can-fix-this-cory-doctorow <comment><USER2> Guys. He's saying that while technology made it easy for elites to protect themselves, it's also begun making it easy for groups undermining those elites. An example of the former is how easy dragnet surveillance is today. An example of the latter is how easy cryptographically secure communication is today. That's the entire essay.

There's some rubbish going on in this comment section about fundamentalist Islam but it's not an important part of the article. Spare yourself the discussion.

<comment> aaron-lebo He mentions Islam twice (he circles back around to it), so it is an important part of the article. Besides, what is militant Islam but the most effective harnessing of technology to undermine elites there is? To ignore that is to ignore a very practical example of this at play.

<comment><USER3> Militant Islam is very useful to elites. The U.S. particularly constantly screws around in the Middle East supporting groups that later become terrorist targets of ours. The biggest offenders have the U.S. governments' hands all over them before they became that. The U.S. protects Saudi Arabia and gives military aid despite them harboring top promoters of terrorism. The media and U.S. government here constantly warn people about terrorism with the defense contractors making billions from that and powermongers getting all kinds of laws such as Patriot Act passed when people were afraid. They also like doing this with threats from drug dealers, kidnappers, and pedophiles. There's even a meme for it they do it so much on Internet side:

[https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalyp...](https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalypse)

</comment></comment></comment><comment><USER4> Technology improvement: Ranked Choice voting

Political impediment: Dismantles the two party system and its vested interests.

Technology improvement: Algorithmic redistricting

Political impediment: Eliminates a strategic job security system for already- elected politicians.

Technology improvement: Cryptography

Political impediment: Eliminates a surveillance and control mechanism of politicians.

This is why we need some form of limited direct democracy. Politicians will never vote for something that directly or indirectly contradicts their own personal self interest. They won't vote for shorter term limits, bans on insider trading, stronger 4th amendment protections, ranked choice voting, objectively neutral redistricting, etc. Technology can only help us to the extent that policy and politics allow it.

<comment><USER5> These are all great points. In some cases, ballot initiatives offer some hope. Check out Represent.US - they're using ballot initiatives to push for things voters support but elected leaders often don't.

<comment><USER6> Check out California to see the sheer lunacy of the ballot system in action. Voter apathy combined with an incredibly uninformed voting population, and on top of that the inability to make _any_ political modifications to a prop once it's passed? Yeah. Brilliant plan for populism, but otherwise not so good.

It gave us prop 8, written deliberately confusing to sway the vote. It gave us prop 47, which was a truckload of measures, many good, some horrible. Resulting in a huge increase in property crimes, which was a side effect that you'd only realize if you actually read the damn thing instead of the summary. Voters don't have that attention span. It gave us prop 69, essentially a state-run DNA database - into which you're entered on arrest instead of conviction. Because "but the children" always sells.

<comment><USER7> Or Brexit where people voted as a sign of protest, not because they wanted it. People who voted for it were surprised it passed.

"The notion that many people who voted "Leave" in the EU referendum now regret their vote because they didn't think "Leave" would win or they didn't realise the consequences of leaving the Single Market would be so bad." [1]

I think many of the problems of representative democracy stem from the fact that people don't read the bills, and they dont check their representatives voting history. Direct democracy seems much worse in that regard.

1\. [http://www.businessinsider.com/brexit-vote-regret-leave- marg...](http://www.businessinsider.com/brexit-vote-regret-leave-margin- victory-2016-10)

Edit: added additional thought

</comment></comment></comment></comment><comment><USER8> In other words, it's the technology stupid.

I wouldn't claim it's making it more unequal though but rather it pushes the "highlander principle" on any industry or nation that becomes "technologized".

Contrary to locally based businesses or nations like restaurants or several states in ex. Africa where technology doesn't have access, in a technology driven groupings there mostly can be one and a few runner ups far far down.

But yeah the way out of the problems of technology is trough technology. I wonder if not jumping onto the technology bandwagon will render som nations obsolete in a few years.

</comment><comment><USER9> > While Saudi hydrocarbonism denies humanity to women, American hydrocarbonism > denies credibility to climate scientists.

Heh, nice word.

</comment><comment><USER10> The core premise is false. The world is becoming less unequal, not more. Technology is assisting that. That trend has been - aggressively - ongoing for decades. The world is the most equal it has been in recorded history, almost entirely thanks to the rapid spread of technology that began in the developed world and was quickly adopted down the chain economically. The Gates Foundation expends a fair bit of effort every year trying to correct this line of ignorance, it appears to not be making a dent in the problem.

</comment><comment><USER11> One cannot omit policy as a driving force.

</comment><comment><USER12> Interesting read. I expected something more focused on post-scarcity societies and automation.

</comment><comment> aaron-lebo Some thoughts cause I'm bored:

* There are a lot of parallels to Acemoglu and Robinson and their Economic Origins of Dictatorship and Democracy, which puts a strong emphasis on inequality. This seems like a decent review:

[http://neweconomist.blogs.com/new_economist/2006/01/book_rev...](http://neweconomist.blogs.com/new_economist/2006/01/book_review_eco.html)

* "Forming and coordinating groups is the hard problem of the human condition; the reason we have religions and corporations and criminal undergrounds and political parties."

Weirdly contradictory, if forming groups is hard, why are there so many religions, corporations, etc? Forming groups seems to be exceedingly easy and it is perhaps human to want to be part of something larger even if its nonsensical or bad for us.

* "Of course, the power of crypto to organise surveillance-resistant communications lines protects everyone from the coercive power of states: not just nice activist groups that want a fairer society, but also whacked-out white supremacists and Islamophobic conspiracy theorists."

Kind of feels weird to take a shot at "Islamophobic conspiracy theorists" when Islamic terrorist groups are the very "insurgent groups" he's talking about and probably as effective as any other group at using this tech.

Finally, just kind of disagree with the premise. If tech made the Saudis rich, if it is empowering the Zuckerbergs and the Erdogans of the world, then there's nothing inherently good about it. Technology only gets applied within a larger social context, which is why it's not the tech that matters but the civic institutions and social morality which discourages invasions of personal rights and greed which are what really matter. Robert Putnam has some really interesting stuff on this.

[https://en.wikipedia.org/wiki/Social_capital](https://en.wikipedia.org/wiki/Social_capital)

<comment><USER13> I also like the part where:

1\. Fundamentalist Islam is a "delusional superstition".

2\. "Modern insurgent groups" \-- the most famous of which all follow the said "delusional superstition" \-- are the good guys.

3\. Even though fundamentalist Islam is a "delusional superstition," "Islamophobic conspiracy theorists" are still "whacked out".

And Doctorow probably sees himself as religiously tolerant, despite all this. This is why you want to check on your beliefs from time to time, to make sure they're not contradictory.

(And I forgot to mention the part where Saudi Arabia's wealth comes from technology; Doctorow's using "technology" to mean Internet technology, high- bandwidth transmission, and the like, not oil wells and internal-combustion engines.)

</comment></comment><comment><USER14> Am I the only one reading this article as needlessly anti-Islam? I'm not Muslim, but I certainly wouldn't attack their faith as "delusional superstitions".

<comment><USER15> Delusion and superstition is a large part of most religions. It's legitimate to criticize Islam for this, especially considering that morally questionable applications of Islam - such as Sharia - directly reference superstition.

If we accept that more accurate representations of reality generally lead to better outcomes, then criticism effectively becomes a moral imperative.</comment></comment>


The Periodic Table of Videos - <AUTHOR> http://www.periodicvideos.com/ <comment><USER2> The same maker is behind the Numberphile and Objectivity channels. Love the content of both, the former helped me in a job interview.

Periodic Videos is also great, I like the enthusiasm of the Professor.

<comment><USER3> And Sixty Symbols, and Deep Sky Videos, and Computerphile (though Sean Riley mostly runs that now), as well as a dozen other smaller channels and several great podcasts.

</comment></comment><comment><USER4> Worthy subject, but the deindustrialization of Britain didn't spare the chemical industry: [http://chemjobber.blogspot.com/2019/12/younger-uk- industrial...](http://chemjobber.blogspot.com/2019/12/younger-uk-industrial- chemists-express.html)

In the medium run the lack of industrial policy can't be good for the country, you lose too much informal knowledge.

</comment><comment> z-cam I never thought I would learn so much about Tin

</comment><comment><USER5> A small thread from 2010: [https://news.ycombinator.com/item?id=1683554](https://news.ycombinator.com/item?id=1683554)

</comment><comment><USER6> Periodic Table of Videos is a classic. Most high quality and informative videos in the first decade of YouTube probably.</comment>


GitLab (YC W15) is part of the Y Combinator family - <AUTHOR> http://blog.ycombinator.com/gitlab-yc-w15-is-part-of-the-y-combinator-family

<comment><USER2> GitLab CEO here, I would be happy to answer any questions. We're a bit old for a YC company (GitLab started in 2011 and we have a team of more than 10) but we only incorporated last year.</comment>


NSA - RDRAND - <AUTHOR> http://lxr.free-electrons.com/source/arch/x86/kernel/cpu/rdrand.c#L35 I've been reading some stuff about all this mess and i've decided to check out the implementation of RDRand. I found this "we are architecturally guaranteed a reseed"  a bit confusing ,  maybe someone with more experience in random number generation and encryption makes some sense out of it .. if you check the code there's a ASM call if the feature is supported and that's it. I found it curious <comment><USER2> That's just the code in Linux that calls RDRAND.

Here is the actual instruction in VHDL:

      --
      -- copyright NSA, Top Secret//UMBRA
      --

      entity RDRAND is
      port(
        RND: out rnd_long
      );
      end RDRAND;

      architecture RDRAND of x64_op is
      begin

        RND <=  x"4e5341746f524e44";

      end RDRAND;</comment>


Google Updates Google Docs With 450 New Fonts, 60 New Templates And More - <AUTHOR> http://techcrunch.com/2012/05/02/google-updates-google-docs-with-450-new-fonts-60-new-templates-and-more/ <comment><USER2> I am happy to hear about new fonts; this seems overdue. Now, I'd really like Google Docs to allow setting a document's language. Currently, if you want spell-check in a foreign language, you have to change the language in your account settings, which then changes the UI language too. I want english language UI, with foreign language support in the document.

<comment><USER3> Does...

       File -> Language -> $language_name

do what you want?

<comment><USER2> No. I can't tell what that does. If I create a new document, and then set File -> Language -> French, and then begin typing, it will still spell-check in English.

<comment><USER4> Maybe that depends on your browser spell-checking options?

</comment></comment></comment></comment><comment><USER5> Well, at least users have to add them to the dropbox list manually. The cool thing of Google Docs, for me, was that it didn't allow many options, to avoid the mismash of informal, unchecked styles that happens in Word.

With this Office-ification of Docs I see a potential disruption. Maybe a LaTeX-like collaborative WYSIWYG editor? That is, one that has only four or five possible document types, and is very opinionated and consistent in how the document is styled. Like TeXmacs, but online and simpler.

<comment><USER6> I've considered writing something similar but I wasn't sure if there'd be any demand. I want an online collaborative editor whose paradigm is more LaTeX than Word. My original motivation was for collaborative academic writing in my old lab, but I think it could be useful for a broader technical audience, as well.

<comment><USER7> There is sharelatex.com for this, but I think using Google Docs with Google Drive and compiling the LaTeX locally might be a better solution.

</comment></comment></comment><comment><USER8> Unfortunately, there have been a few other less welcome changes recently that weren't mentioned in the TechCrunch article. For example, I can no longer see the revision history of a very important spreadsheet at all: it seems to have become corrupted somehow a few days ago, and winds up half-drawn with no content showing any time I click on an older version now.

As much as I appreciate allowing more design features in Docs, I think they should first have addressed the glaring omissions in basic functionality (by which I mean things real spreadsheets did a decade or two ago, not "basic" things that are very important but only to 5% of the market) and the horrible reliability and backward compatibility.

<comment><USER9> I suspect "please add more fonts" is a feature more requested than "revision history is sometimes corrupted, please fix."

<comment><USER8> Sure, but if you compare Google Docs with even everyday, popular functionality in say Excel or Word, it's sorely lacking. It's not really a competitor product for a serious office suite, whatever the PR people would like you to think. It's more a cheap and cheerful office suite but with real-time collaboration features (which is just fine if that's what you need, but a very different kind of product).

<comment><USER10> > It's not really a competitor product for a serious office suite

How many people really use the "serious office suite" features in Office, though?

Most of the users I've encountered just want to add clip art to their PowerPoint. The folks writing an entire application framework in Excel macros are going to keep Excel, sure, but they're pretty rare.

<comment><USER8> I reckon there are about 3-4 general levels of interactivity with a "classical" office suite:

1\. Puts data in, and uses little else.

Word is a glorified text editor.

Excel is a table editor with built-in arithmetic.

2\. Puts data in, uses slightly more advanced features.

Word documents use some simple styles for consistent formatting. They get spelling checked and word counted. They include the occasional picture, numbered list or table.

Excel spreadsheets use named cells and some basic formatting. They might include a few tabs, perhaps separating multiple input tables and adding some summary tables/charts. Summaries calculate some basic statistics. Charts are formatted to be useful instead of pretty.

3a. Uses "power user" features

Word documents are based on carefully constructed templates with comprehensive sets of styles. Long documents generate tables of contents, indexes and cross- references automatically. Collaborative documents have changes tracked and are passed around for review/annotation.

Excel spreadsheets perform serious calculations, use conditional formatting, etc. They are used to explore scenarios interactively.

3b. Uses automation and integration features

Word documents have custom macros to help when producing specific document types. They might combine data from other sources outside the document into a single place, use mail merge, etc.

Excel spreadsheets have custom macros to handle larger data sets, explore scenarios automatically, etc.

My problem with Google Docs isn't that it doesn't support 3a and 3b, it's that it barely supports level 2. You often _can't_ produce professional-level work with Google Docs, because it lacks even the "slightly more advanced" features, never mind the power user or automation/integration capabilities. And while not everyone is a geek like me who wants to streamline everything and produce perfect results all the time, I can honestly say that in every office I've ever worked in, almost everyone operated on at least level 2.

</comment></comment></comment></comment></comment><comment><USER11> I've never been able to figure out how to get my own styles. In particular I'd like a style named 'code' that I can then use for various code and API text in documents.

</comment><comment><USER12> I liked the minimal font selection before, since it encouraged focus on content over style. Since there were so few options, all the offered fonts had to be crisp and professional-looking in any context. But I guess more is better…

On another note: the number one feature I want from Google Docs is a permanent setting for page size. My pages are always A4 - why should I have to change the default value every single time I start a new doc?

<comment><USER13> That was added in the same update, I believe. Now in the "File -> Page settings" dialog there's a "Set as default" button.

<comment><USER12> Fantastic! Thanks for pointing that out; I don't know how I missed it.

Our printers are set for A4, so trying to print letter-size causes them to beep and refuse to print without user intervention.

</comment></comment></comment><comment><USER14> Docs already had Comic Sans. Why use anything else?

</comment><comment><USER15> The biggest and most appreciated change for me is its stability. Gdocs was either crashing or down so frequently in previous few months that I thought they're abandoning it for some reason. It was so bade that I looked for alternatives like Zoho and others. Having had much trouble in the past month, hope they keep it up.

</comment><comment><USER16> I am really starting to like Google docs as a possible Evernote replacement, as soon as they improve their offline editing support. One thing I can't figure out is how to change the default font for new documents. I try saving the "Normal Text" style with Ubuntu as my font, but new documents always revert back to Arial.

</comment><comment><USER17> Google,

Please add a warning that when a serif font < 24px is used for the main text, readability is degraded on most screens (new iPad being a notable exception).

Sincerely,

The internet.

<comment><USER18> Really? I find Georgia extremely readable on desktops and laptops, and the NYTimes makes heavy use of it at 12px in article bodies. Looks a little dated/old school, but I've never heard of Georgia (or Times for that matter) having "degraded" readability.

</comment></comment><comment><USER19> Is my browser's zoom setting supported yet?

<comment><USER20> As far as I know, it's an avoidance for a WebKit bug wherein elements' pixel positions and sizes are simply wrong at non-default zoom levels; see <https://bugs.webkit.org/show_bug.cgi?id=60318> and all related.

</comment></comment><comment><USER21> Two words: citation manager.

</comment><comment><USER22> A word count on the summary page would be nice for text docs</comment>


How to remain secure against NSA surveillance - <AUTHOR> http://www.theguardian.com/world/2013/sep/05/nsa-how-to-remain-secure-surveillance <comment><USER2> _1) Hide in the network. Implement hidden services. Use Tor to anonymize yourself._

SKETCHY ADVICE. Tor might make targeted attacks on you personally take more work, but because Tor attempts to provide anonymity and not confidentiality or integrity, it may make you _more_ susceptible to dragnet surveillance.

 _2) Encrypt your communications. Use TLS. Use IPsec._

Great advice. But prefer TLS to IPsec, which is largely the provenance of commercial systems and the product of much more vendor-centric standardization.

 _3) Assume that while your computer can be compromised, it would take work and risk on the part of the NSA – so it probably isn 't._

Sure, I guess.

 _4) Be suspicious of commercial encryption software, especially from large vendors._

Absolutely, great advice.

 _5) Try to use public-domain encryption that has to be compatible with other implementations._

This starts out great. This sentence is great. It continues:

 _Prefer symmetric cryptography over public-key cryptography._

Dead on, absolutely. Number-theoretic public-key crypto is terrifying. But then:

 _Prefer conventional discrete-log-based systems over elliptic-curve systems; the latter have constants that the NSA influences when they can._

ARGH NO ARGH. First, conventional DLP systems also have suspect parameters. Second, the best ECC systems have parameters of well-known provenance. Third, ECC systems are _known_ to be stronger than DLP systems. In fact, the most likely source of any claim about an NSA cryptographic breakthrough is that NSA has a viable attack on RSA-1024 (an IFP system, but six of one).

If you were going to change one thing about the way you decrypted in the wake of today's "new information", make it be that you abandon RSA.

<comment><USER3> RSA-1024 was assumed already to be breakable, but RSA-2048 and RSA-4096 will likely stay unbreakable for a long time.

It's really as many suspect - they are prepared for targeting the crypto implementations, through exploits or backdoors and if they can't they can target your computer.

Also, open-source is of course safer and some of us have been repeating for years that you can't trust binary blobs, security being just one reason out of many.

<comment><USER4> >Also, open-source is of course safer and some of us have been repeating for years that you can't trust binary blobs, security being just one reason out of many.

Only if you're auditing the code and building it yourself, or have a trusted place where that's done. I would wager that for the vast majority of users are just using the binary blob provided by someone. Otherwise, the "code" you're using could be as compromised as any closed source program.

<comment><USER3> Again with the vast majority of users fallacy? Bring up a story of grandma for a full picture too.

Binary blobs can be checked easily if they originated from the source code published. Major Linux distributions, like Debian, have people all over the world auditing the repository. If a backdoor is planted, with the repository being public, most projects have a full history of whom added what and when. Code reviews happen too.

<comment><USER5> You're right in that this mostly foils the NSA in its role as a global passive attacker. However, having a FOSS OS doesn't foil _active, targeted attacks_ at all: the version of a package in the repo could be perfectly safe, while the version distributed to _just your computer_ could be backdoored. (The NSA, after all, can FISA-order someone to give up their package signing key just as well as they can grab a decryption key, and then MITM just your connection to deliver an "automatic security update" that nobody else got.)

<comment><USER6> _...while the version distributed to_ just your computer* could be backdoored.*

They would have to get the base distribution signing key, which is probably a shared secret that requires multiple people to unlock.

Have there been any hints of NSLs or FISC orders requiring the disclosure of private Linux distribution keys, some of which may not even be held in the US?

<comment><USER5> The funny thing is, you don't actually need to replace a package that's part of the base distribution. Every package format we have (RPM, DEB, etc.) runs its install- and upgrade-scripts as root, so every package can potentially do anything on install, including patching the installed files of other packages (or cleverer things, like adding SSL trust roots.)

So, since they don't specifically need to patch your openssl package to compromise your openssl library, they could just as well suborn the signing key of (presuming Ubuntu) some PPA author, as long as the user they're trying to bug has that PPA in their sources.list.

<comment><USER7> Solaris introduced some concepts in its IPS packaging to avoid packages changing the system. IMHO, it is very good but adds some pain to developers and sysadmins alike.

[http://www.oracle.com/technetwork/server- storage/solaris11/t...](http://www.oracle.com/technetwork/server- storage/solaris11/technologies/ips-323421.html)

That coupled with system wide snapshots is a great tool to audit a system after a patch is applied.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> "Basically, the NSA asks companies to subtly change their products in undetectable ways: making the random number generator less random, leaking the key somehow, adding a common exponent to a public-key exchange protocol, and so on. If the back door is discovered, it's explained away as a mistake. And as we now know, the NSA has enjoyed enormous success from this program." -Bruce Schneier

So when Rasmus Lerdorf checked in a change to PHP that broke crypt(), and then made a release without bothering to run the tests (he claimed that "This is mostly because we have too many test failures which is primarily caused by us adding tests for bug reports before actually fixing the bug."), was that actually because he was working for the NSA to install a giant backdoor in PHP, and not just completely incompetent and totally negligent? [https://plus.google.com/113641248237520845183/posts/g68d9RvR...](https://plus.google.com/113641248237520845183/posts/g68d9RvRA1i)

"We have things like protected properties. We have abstract methods. We have all this stuff that your computer science teacher told you you should be using. I don't care about this crap at all." -Rasmus Lerdorf

"I'm not a real programmer. I throw together things until it works then I move on. The real programmers will say "Yeah it works but you're leaking memory everywhere. Perhaps we should fix that." I'll just restart Apache every 10 requests." -Rasmus Lerdorf

<comment><USER9> It sounds like Mr. Lerdorf isn't really qualified to do what he was doing. Not a good example of an NSA plot.

<comment><USER8> "For all the folks getting excited about my quotes. Here is another - Yes, I am a terrible coder, but I am probably still better than you :)" -Rasmus Lerdorf

</comment></comment></comment><comment><USER10> Basically, you can't avoid being surveilled without radically altering your lifestyle. If you did, then it'd be something like:

0\. Don't use a cell phone.

1\. Don't use Google.

2\. Don't use Skype or any other VOIP or telephone service.

3\. Don't use social networks.

4\. Don't use electronic money, including the bank account you are presently being paid in to.

5\. Don't use individually booked international flights or ships.

6\. Don't use email.

7\. Don't communicate regularly with the same set of people. If you must communicate, do it either using steganography or in brief and without revealing any identifying information (spelling, voice, writing style, etc.)

<comment><USER11> 8\. Don't use anything which isn't FOSS or compiled from source.

<comment><USER12> [http://cm.bell-labs.com/who/ken/trust.html](http://cm.bell- labs.com/who/ken/trust.html)

<comment><USER13> [http://www.dwheeler.com/trusting-trust](http://www.dwheeler.com/trusting- trust)

</comment></comment></comment></comment><comment><USER14> From the article:

"Since I started working with Snowden's documents, I have been using GPG, Silent Circle, Tails, OTR, TrueCrypt, BleachBit, and a few other things I'm not going to write about."

My take on that is that the author does not trust all the things he advises us to use, since he relies on other things he is not going to tell us about. Which means he is safe(r), we are not, and wont be, since he wont share.

Great. What use is all that then? None.

BTW, Just read that O2 UK are blocking VPN traffic.....

<comment><USER15> He is giving suggestions for _improving_ your security, not for perfect security. And one additional way you can improve your security is to not led a potential adversary know all the steps you take - Schneier is high profile, and with an admission he's worked on Snowden document, even more so; there's every reason for him to assume that if he wasn't a direct NSA target before, he is now. It's a trade off.

</comment></comment><comment><USER16> In addition to trying to obscure traffic, we should be generating large amounts of spurious traffic that's difficult to analyze and store.

</comment><comment><USER17> > Basically, the NSA asks companies to subtly change their products in > undetectable ways: making the random number generator less random, leaking > the key somehow, adding a common exponent to a public-key exchange protocol, > and so on. If the back door is discovered, it's explained away as a mistake.

You have to wonder about the Android SecureRandom weakness just discussed in recent weeks:

[http://android-developers.blogspot.com/2013/08/some- securera...](http://android-developers.blogspot.com/2013/08/some-securerandom- thoughts.html)

Exactly the situation described by Schneier. Normally I would dismiss this out of hand as pure tin hattery. Scarily, I'm actually wondering.

</comment><comment><USER18> Encrypting DNS traffic should also be considered:

[http://dnscrypt.org/](http://dnscrypt.org/)

</comment><comment><USER19> "I bought a new computer that has never been connected to the internet. If I want to transfer a file, I encrypt the file on the secure computer and walk it over to my internet computer, using a USB stick."

Wasn't this one transfer mechanism for stuxnet? Once a computer is infected, you have to at least suspect that anything that touches it directly or indirectly is infected. It's like an STD.

<comment><USER20> Format the thumb drive before mounting it on the airgapped computer. It is cheaper than using CDs.

<comment><USER21> It looks like you can DVDs in bulk for between 20c and 10c per disc. If you're _really_ serious about protecting your airgapped computer, this is a very reasonable price to pay.

<comment><USER20> Sure, so is using a rewriteable DVD, but neither is much more secure than formatting thumb drives before mounting them. Convenience is the only argument, and it is not all that hard to set things up so that you always format thumb drives that are plugged in.

<comment><USER22> A thumb drive is, or can be, a tiny computer that can lie about its contents depending on what's asking. I don't see a particular exploit in Schneier's case, but a thumb drive could be made that behaved differently depending on whether a Mac or Windows PC was trying to talk to it.

</comment></comment></comment></comment></comment><comment><USER23> I may have misread. Did Bruce Schnier just admit that he has Snowden documents on an air gapped computer, likely sited at his place of residence? If he is a "US person reasonably believed to be inside the US" then I imagine that could put him on the list for a 2am wakeup call.

<comment><USER24> Am I missing something? What motive would the US have for raiding his house?

It's not like the US is desperate to know what's in the documents. They already know what's in them. They're the US's own documents. They just want to stop them being published. Raiding Schneier wouldn't do anything to help with that, it'd just mean he has to go over to the Guardian's offices to do the analyzing - it's not like the copies he has are the only ones.

The Guardian's already confirmed that they have copies at at least their New York and Brazil offices, and you can bet they have plans in case those are raided. (Last resort, they're almost certainly part of the august 2013 Wikileaks insurance release, which someone just needs to tweet the password for if somehow all the guardians' copies are simultaneously destroyed).

<comment><USER25> The US actually does not know the specific documents that Snowden took, or how much he took, because he was able to bypass their security. This is suspected to be the reason that Miranda was detained in the UK.

<comment><USER26> Which is the reason that they now know what Snowden took.

</comment></comment></comment></comment><comment><USER27> Why use symmetric cryptography over public-key? I thought RSA was theoretically secure as long as factoring sufficiently large prime numbers is impossible.

<comment><USER2> Argh.

First, RSA is about factoring composites.

Second, factoring those composites at popular key sizes isn't impossible.

Third, public-key algorithms are much harder to get right; they involve direct mathematical operations on plaintexts and devolve to well-studied math problems much more readily than symmetric ciphers do.

You should absolutely avoid public-key crypto, including public-key key agreement schemes like Diffie-Hellman, if your needs don't absolutely require them.

<comment><USER28> > You should absolutely avoid public-key crypto, including public-key key > agreement schemes like Diffie-Hellman, if your needs don't absolutely > require them.

Is there an alternative to public-key crypto? We all need to do stuff online.

<comment><USER2> Sure there is: pre-shared keys, exchanged out-of-band.

<comment><USER28> You probably know what I was getting at. Public-key crypto is _very_ important in today's world. If we can't use the current system, we need something to replace it. Pre-shared keys is for a different scenario.

<comment><USER2> You are missing both Schneier's point and mine. The point is that if you can contrive of a way to (perhaps inconveniently) pre-share static keys, you should consider doing that instead of relying on number theory to protect your secrets.

<comment><USER28> > The point is that if you can contrive of a way to (perhaps inconveniently) > pre-share static keys, you should consider doing that instead of relying on > number theory to protect your secrets.

No I got that just fine. As you know, I'm suggesting that not using public-key crypto or something else for the same purpose is impractical.

</comment></comment></comment></comment></comment></comment></comment><comment><USER29> This is from the Guardian:

 _Among the specific accomplishments for 2013, the NSA expects the program to obtain access to "data flowing through a hub for a major communications provider" and to a "major internet peer-to-peer voice and text communications system"._

What could this be: "major internet peer-to-peer voice and text communications system" ?!

We already know Skype is compromised and it's not P2P anymore anyway. So what are they talking about? Which other _major_ P2P service for voice and text is there?

<comment><USER30> Hangouts?

</comment></comment><comment><USER31> "Basically, the NSA asks companies to subtly change their products in undetectable ways: making the random number generator less random, leaking the key somehow, adding a common exponent to a public-key exchange protocol, and so on. If the back door is discovered, it's explained away as a mistake."

I have to wonder if, maybe in some instances, this is why it takes so long for some vendors to patch the vulnerabilities in their software. Maybe some of the problems we report were really there intentionally?

</comment><comment><USER32> I suspect the real answer to "How to remain secure against NSA surveillance" is; go offline.

<comment><USER33> This is of course the right answer. And the _only_ answer if you are actually planning something you know to be nefarious. It's going to be an I retesting law of uninteneded consequences now that only the better criminals and terrorists will escape this dragnet.

</comment></comment><comment><USER34> Psh! I know how to fool the NSA! I'll start using 9 character passwords instead of 8.

<comment><USER35> hunter222

</comment></comment><comment><USER36> I don't 'get it': For public key cryptography, the basic math is well known. Then what's needed is some code. The core code for just the en/decryption is quite short. So, just write the core code yourself, directly from the math and/or open source code -- be 100% sure understand each statement of code do write.

Then turn the en/decryption code into just a simple command line program that reads a file and writes a file -- no opportunity for the spooks to corrupt that code either.

Then call it done. So, for e-mail, type some text into a simple file, wash it through own command line encryption software, get out the file of simple text of the base 64 of the encryption, pull that text into the e-mail program, and send it.

I'm not 'getting it' on just where the security vulnerability is here.

Again, the crucial point is that the core en/decryption code is darned short, quite close to the well known math, and can be checked against some open source code.

Then, if everyone writes their own code in this way and discovers that they are 'interoperable', then everyone knows that they did good work even if they never actually share code.

I'm not getting why this can't work?

<comment><USER37> Right, so you go on Wikipedia and implement RSA. You understand every single thing you do.

Oops. You forgot padding. Because of some strange identity that applies to the simple math you just implemented straight from the textbook, all your encrypted data can be trivially decrypted.

<comment><USER13> Or even if you get the algorithm correct, maybe you forgot to handle all the memory the key touches special and it's swapped to disk. Or maybe your implementation is vulnerable to timing attacks or something more obscure.

<comment><USER36> Just trying to send some text via e-mail, so swaps to disk and/or timing attacks should not work. That is, not trying to encrypt streams of voice or video, and do assume that the computer used for the de/encryption is 'secure'.

<comment><USER13> The problem with it being swapped to disk is that it means the decrypted form of your key (you're storing it encrypted by a passphrase, right?) is now persisting while your computer is off, which exposes it to more threats (someone images your disk when you take your computer in for repair).

Timing attacks would certainly be harder if you're never signing anything in a situation the attacker controls, but I'm leery about claiming nothing could be done.

<comment><USER36> > decrypted form of your key (you're storing it encrypted by a passphrase, > right?)

Haven't yet implemented the little de/encryption command line program l described so don't know just how I'd store my private RSA key. The private key would likely be just on my computer some place as just ordinary data maybe with a comment that clearly describes the data as my private key.

I'm not sure what you mean by a "passphrase", but I can guess; with my guess, no, I wouldn't do that because (1) it makes life harder for me and (2) doesn't really make decrypting my data much more difficult for an attacker.

> when you take your computer in for repair

Right, if I lose physical control of my computer, then all or nearly all the data I encrypted can now be decrypted by others.

So, right, for anyone who would lose physical control of his computer for any reason, the 'approach to computer security' I outlined would have a huge hole in it.

In my case, I would never take my computer for repair since I built and repair my own computer.

</comment></comment></comment></comment></comment></comment><comment><USER38> [http://xkcd.com/538/](http://xkcd.com/538/)

<comment><USER39> Please let's not mindlessly post this comic and act that because rubber hose crypt-analysis exists we shouldn't even bother.

One huge point I keep trying to bring up to friends when I talk about security is: yes if you are the specific target of the state or any asymmetrically powerful adversary you are in a lot of trouble.

But with large scale surveillance the bigger concern is not becoming a target in the first place. Properly securing sensitive communications is a good first step in ensuring that you aren't picked up in sweep through the data.

Sure encryption in the first place may flag you, but at least in the current situation it isn't going to be enough to invoke any rubber hose techniques.

<comment><USER38> I propose that we do act like governments can detain you, until you reveal your password, because that does in fact happen.

I propose that people abandon the concept that they can archive their email forever, and instead use systems like a Mission Impossible Tape that self- destructs the instant you're done reading it.

I propose that the only way to stop the government from making you decipher your messages, is if it's impossible for you to decipher them.

Everyone should use Perfect Forward Secrecy systems.

</comment></comment></comment><comment><USER40> I guess this makes NSAKEY[0] probably the NSA's.

[0] [http://en.wikipedia.org/wiki/NSAKEY](http://en.wikipedia.org/wiki/NSAKEY)

</comment><comment><USER41> Wouldn't it be relatively easy for the NSA to run ubiquitous MITM attacks using some certificates in the certificate chain that they have compromised? That way all they need to do is compromise certificates and get in the middle on a large scale (which could be done automatically perhaps) instead of breaking encryption.

<comment><USER2> No, because the anti-surveillance features of browsers like Chrome would flag those MITM attacks, which would compromise sources & methods, which is anathema to NSA.

<comment><USER41> I thought that the browser flags a MITM attack when the information that was sent from the supposed server doesn't agree with the server information received through a different channel (e.g., with the operating system).

If the NSA had compromised certificates on the operating system, how would Chrome detect that a MITM attack was being attempted?

<comment><USER2> Because Chrome doesn't entirely rely on the operating system to verify certificates.

<comment><USER42> I wouldn't trust Chrome's extra methods in this case. Nothing against Google whatsoever, but closed source, commercial software from a company the NSA has expressed a great deal of interest in fooling around with is probably the worst possible choice in this case. Same with Safari and IE.

<comment><USER2> (a) the code in question is part of Chromium, which you should read, and (b) Mozilla has adopted it as well.

<comment><USER42> Google and other corporations still represent a huge risk in that they can be compelled to degrade or modify the feature, and since all you get is a binary blob, you have no way of knowing.

The security provided by the feature, in this case, is then questionable. I'd trust Firefox and Chromium, but not Chrome for this reason.

</comment></comment></comment></comment></comment></comment></comment><comment><USER43> You can't remain secure against an organization that has effectively unlimited resources. All you can do is make it harder for them -- and that is most easily accomplished by non-technical means rather than a more advanced version of existing technical means.

Talk to people face-to-face, maybe?

</comment><comment><USER44> It's pretty funny that SilentCircle's website preaches privacy and information hiding. Yet their site is also littered with trackers for analytics, logging what OS you're using, what hardware, etc.

</comment><comment><USER45> Scheneir says: "Prefer symmetric cryptography over public-key cryptography."

If I were to use only symmetric encryption then how do I prevent man in the middle attacks?

</comment><comment><USER46> So many comments and nobody actually sacks Schneier for working on Windows completely? How much security can you have when you work on top of Windows?

<comment><USER47> Most security researchers use Windows because that's where the 'action is' so to speak. If he wasn't running Windows, he'd be firing up a Windows VM more often than not.

<comment><USER46> seems not unreasonable for work. but there is also a level at which they can't see much of what's happening, because they simply don't have the source code, right? so for the home office it would make sense a lot to use Linux.

</comment></comment></comment><comment><USER48> For now, we need to stop thinking and talking like this. This race is lost. The government is ready to record everything, but we are not ready to encrypt everything.

It's not enough to protect yourself, even if you could. You are not OK even if you manage to protect yourself, because your friends and family and loved ones and colleagues are mostly, if not all, compromised.

The long term goal should still be for everything to be encrypted. But the near-term goal should be to utterly dismantle the NSA. It should all be taken apart, brick from brick, and destroyed. The people who put it into place should be removed from power and prosecuted.

<comment><USER3> If data is easy to eavesdrop, then somebody will. This is also an engineering problem. We've got broadband, we've got capable CPUs, there's no excuse for not encrypting everything.

<comment><USER14> And if they do suspect you of something, they will water-board you in a country with no human rights to stop the "ticking bomb" they use to excuse themselves. Not sure how long I'd last, TBH. If you are lucky, you'll got to jail.

That's the way it is, and will be until people wake up and change politics.

<comment><USER49> The problem with that is it isn't very scalable. The NSA being able to spy on the world is very much a very recent economic reality.

<comment><USER50> Yes, though just because it's not scalable doesn't mean it's not an injustice.

<comment><USER51> Or likely to deter others. Terror, flipped.

</comment></comment></comment></comment></comment></comment><comment><USER52> I know they've had problems in the past, but is Cryptocat now a decent way to securely communicate?

<comment><USER49> It isn't a secure product, but it's a crypto product something that has decent UX that isn't from a huge compromised company such as apple or google. In this space it makes it rare. It all depends on your adversary. For family members, stalkers and most employers, it's probably great.

<comment><USER53> How is it more secure against "family members and stalkers" than, say, Gmail?

<comment><USER49> Well it's more a social design. Google probably has a record of all of your emails, deleted or not somewhere and a court order can get those emails. Cryptocat will not. Gmail is also very integrated into most people's devices, so it's easier to get to someone's email records by getting at their computer, phone, cookies, etc.</comment></comment></comment></comment>


Wait, why the hell is the 'race to 5G' even a race? - <AUTHOR> https://www.theverge.com/2019/5/23/18637213/5g-race-us-leadership-china-fcc-lte <comment><USER2> >But I sincerely doubt that all of these companies will pick up and move to China or Europe if the United States builds 5G networks slightly slower.

Author is not aware that there are not US based telecom companies left to compete for 4G/LTE/5G air infrastructure installations. There are only two Nordic companies and two Chinese plus Samsung with the smallest 3-4 percent market share.

US has never been the the fastest to adopt and install new mobile infrastructure and this has lead to the current situations. Nordic companies had small advantage in their home turf and they took over. Chinese came late into the game late are result of systematic work by their government.

Home markets are important for new technologies. US companies and startups are not going be first to sell 5G technologies and services to foreign markets if their home market is slow to adopt.</comment>


MIT Gantt Editor JavaScript Plugin – New Release - <AUTHOR> https://gantt.twproject.com/ <comment><USER2> Cool that its free - I'm not aware of other js packet that does this and makes your day. Thanks!

</comment><comment><USER3> Amazing plugin! I already use it in the past for a personal project, great new release!

</comment><comment><USER4> Hi, does it support jQuery 3?

<comment><AUTHOR> Yes, it does! The new version supports JQuery 3.</comment></comment>


Salesforce CEO is telling an odd story about how Microsoft tricked him - <AUTHOR> http://www.businessinsider.com/benioff-claims-to-feel-fooled-by-nadella-2016-11 <comment><USER2> I've always wondered why LinkedIn didn't go into CRM to compete with salesforce since they have all the data on who people are and who works where. Now with the combination of dynamics the future doesn't look so good for Salesforce.

It's pretty dirty what happened to Benioff but maybe that's just normal in those ranks.</comment>


Using NLP to Identify Redditors Who Control Multiple Accounts - <AUTHOR> https://towardsdatascience.com/using-nlp-to-identify-redditors-who-control-multiple-accounts-837483c8b782 <comment><USER2> I recently became a mod of a small subreddit and this is super interesting. If this was made into a mod tool I would use it.

I'm wondering what else you could use this analysis for. I imagine something similar could work on Twitter? Like if you blocked somebody and they make another account to harass you.

</comment><comment><USER3> These kinds of tools tend to require a certain amount of data before they can give you any useful results. That would tend to be harder to get on short-form twitter as opposed to the longer amount of space you can get in reddit.</comment>


Blink Protocol, new Native format, updated Compact format - <AUTHOR> http://blog.blinkprotocol.org/ <comment><AUTHOR> Feedback is welcome.</comment>


New Rails-like Framework from 37signals for HTML5 Mobile Apps - <AUTHOR> http://thinkvitamin.com/mobile/new-rails-like-framework-from-37signals-for-html5-mobile-apps/

<comment><USER2> Hey folks, there's nothing to see here right now. We spent three weeks experimenting with some new tech to see what we could build, and ended up with something that looks a bit like Rails, but entirely client-side and written in CoffeeScript.

The project driving the framework—an HTML5 mobile UI for Basecamp—has been on hold for about a month now, and we're still a ways off from having anything to show. It just isn't a priority for us right now. When (or if) we do have something we'll be sure to post about it on our blog.

<comment><USER3> Why not put it up on Github so we can help you finish it?

I'm currently a full time jQTouch developer, but I would much prefer a working environment like the one you're describing. I would certainly be willing to help develop it.

<comment><USER2> We have open-sourced one component, the Eco template language: <https://github.com/sstephenson/eco>

A couple of other smaller components are ripe for release, too. But the framework itself needs more work before it can be made public, and that work is directed by the needs of the application.

</comment></comment></comment><comment><USER4> For anyone interested in the idea of having multiple views in JavaScript (with their own URLs!), "Sammy" is a client-side JavaScript framework that's like Ruby's Sinatra: <http://code.quirkey.com/sammy/>

Indeed, what Ryan mentions sounds a bit like the ideas of Sammy, Backbone, and HTML5 local storage and offline caching blended together into a single tasty package.

<comment><USER5> If you'd like to browse an example Todos application (with annotated source code) that fuses Backbone.js and HTML5 local storage, here's a good place to start:

[http://documentcloud.github.com/backbone/examples/todos/inde...](http://documentcloud.github.com/backbone/examples/todos/index.html)

The particular Backbone/LocalStorage integration works quite well for this little app, despite being simplistic:

[http://documentcloud.github.com/backbone/docs/backbone- local...](http://documentcloud.github.com/backbone/docs/backbone- localstorage.html)

 _Edit_ : There seem to be a lot of folks who think that Sammy is the only way to get client-side routing -- nothing could be further from the truth. Sammy asks you to structure your entire app around an inappropriate faux-server-side API, and Sammy apps don't work correctly in Internet Explorer because Sammy doesn't use an iframe to set history in IE. Doing hashchange events yourself only takes about a page of code, and handling hash URLs is a relatively tiny portion of a client-side app:

<https://gist.github.com/624773>

That said, so many folks have asked for hashchange routing that perhaps it would be wise to build a Backbone plugin for it that smooths over the difference between pushState and hashchange...

<comment><USER6> Completely agree, and I'd definitely recommend an integrated history management component.

</comment></comment></comment><comment><USER7> After node, this is the second big project to endorse Coffescript (although this is still vapourware of course). And 37signals rock at marketting.

I' glad the language is getting traction.

<comment><USER6> Not really sure to what extent Node is embracing coffeescript, unless there's news I haven't read you could link to.

</comment></comment><comment><USER8> Why only mobile? We need something like SproutCore, but easy like Rails.

Backbone.js maybe?

<comment><USER9> Why ? I would say: "Focus, focus, focus"!

After doing my experimentations with various mobile stuff, I tend to think I'd prefer investing time in something specific to mobile like this or sencha, and rely on a (Rails or other) app with JSON API for the site or back-end.

</comment></comment><comment><USER10> Doesn't sound very mobile-specific to me. Buzzword? But still, I'm interested to hear more.

<comment><USER11> The target seems very mobile-specific. HTML5 is better supported on mobile, and the proposed model sometimes fits "desktop" web apps, and almost always mobile web apps.

So yes, buzzword, but it fits.

</comment></comment><comment><USER12> Ah, Coffeescript, the Ratfor of a new generation…

<comment><USER13> It's mildly annoying. Unlike Fortran, JS doesn't desperately need a preprocessor language. Adding another layer of "abstraction" and some syntactic sugar will make the process of developing good JS needlessly complex and fragile.

<comment><USER7> So "it turns out"[1] that Coffescript will make the process of developing good JS needlessly complex and fragile.

Would you care to elaborate?

From the coffeescript site :

> it compiles into clean JavaScript (the good parts) that can use existing > JavaScript libraries seamlessly, and passes through JSLint without warnings. > The compiled output is pretty-printed and quite readable.

[1]<http://jsomers.net/blog/it-turns-out>

</comment></comment></comment><comment><USER14> Own programming language, own templating engine - looks like NIH syndrome. But with 37signals' developers they could afford it.

<comment><USER9> The trick with NIH syndrome is balancing, as with any other syndrom. Once you know about it, you can also detect situations where it's worthy rolling your own (GitHub's Resque is another successful example of that).

<comment><USER14> I agree that HIN is not always bad, Joel has good article about this: <http://www.joelonsoftware.com/articles/fog0000000007.html>

<comment><USER15> Is HIN a reinvention of NIH? :-)

<comment><USER14> when Forth programmers are not reuse code I believe it should be called HIN :)

<comment><USER15> Touche!</comment></comment></comment></comment></comment></comment>


The Advantage of Abundant Thinking - <AUTHOR> http://firstround.com/review/the-remarkable-advantage-of-abundant-thinking/ <comment><USER2> The main thing that has really impacted my productivity and happiness is following a set routine for an hour whenever I get up. So I do the following :

      1. Brush
      2. Meditate - 15 minutes
      3. Write - I usually write "3 things that I am grateful for" and "3 things to focus on that particular day"
      4. Exercise - 15 minute run

I do this whenever I get up. So it's not like I get up at 6 in the morning everyday. I just get up 6 hours after sleeping. The advice was given one one of Tim Ferris' podcast and has done wonders for me. I would highly recommend trying it out.

Start small. If 15 minutes of anything is too much start with 5 minutes. That's what I did.

<comment><USER3> 6 hours is not enough sleep

<comment><USER4> It is for some people, and it isn't for others, which is why this kind of generic advice is amazing if it fits you exactly, and awful if it doesn't.

I can function on six hours, but not well. I also can't easily take 15 minutes to meditate in the morning, because I have a two month old baby I have to help care for in the mornings. This somewhat limits my ability to meditate and exercise.

<comment><USER5> I don't really understand how your baby makes it difficult to take 15 minutes to meditate, because I would imagine you were sleeping in increments longer than 15 minutes. So why is this? Is the baby waking up when you wake up?

<comment><USER4> > _Is the baby waking up when you wake up?_

It's more accurate to say that I wake up when the baby wakes up - I hear her start to stir because she's hungry/awake, and that rouses me.

But yeah, she also tends to wake up when one of us does in the morning, unless we're very quiet, since she's just about slept out at those times.

I tend to also let my wife sleep in and take care of the kid in the morning, since she takes care of her all day, and half of the night. It seems unfair to dump the kid on her in the morning, too, while I exercise and meditate.

> _I would imagine you were sleeping in increments longer than 15 minutes_

Some bad nights, you'd be surprised.

<comment><USER6> This is off topic, but while we are on the subject: does anyone regret having children because of issues like lack of sleep, etc? Did that feeling change after the baby stage?

</comment></comment></comment></comment></comment></comment><comment><USER7> This looks like an attempt to monetize an evangelical Christian concept.[1]

From the article: _The ideal attitude is what she calls Abundant Thinking — a mindset that gives you the creative agency and grit to reach your vision — and, on a daily basis, to design your own life. When Verresen first meets most of her clients, they're in reactive mode. It's like they're in a movie, acting in their job and life without knowing the script or having perspective. Her goal is to put them in the director's chair, with more choices, perspectives and possibilities to rewrite and upgrade the script as they go._

From an evangelical site: _One way of viewing abundant life is to see when people have been changed by the power of Christ; they live different lives, which affects all aspects of their experience. In missiololgy, we call that "redemption and lift." This isn't just true individually, but can also be on a cultural level. So, spiritual change, accompanied by better decisions, does often lead to better circumstances financially. (Sometimes it get's you arrested and martyred, so don't miss the point here.)"_

[1] [http://www.christianitytoday.com/edstetzer/2015/march/what-d...](http://www.christianitytoday.com/edstetzer/2015/march/what- does-it-mean-to-have-abundant-life.html)

<comment><USER8> Lest anyone dive into religious polarization around this, it's worth pointing out that such psychological doctrines have a long history, back through Norman Vincent Peale and Napoleon Hill to the New Thought movement of the late 19th- early 20th century [1] and a whole kaleidoscope of religious splinter groups. Many of these were Christian, but mostly marginally so; a famous example is [2]. Then there's the New Age wing to this (think The Secret) that goes back to the Theosophists and alchemical traditions. Then again there were more philosophical versions, like the Transcendentalists. You can find this type of thing in Emerson. The history and literature is rich. More recently it is beginning (as one would expect) to take scientific and quasi-scientific forms, including attempts to test it experimentally. Not clear yet what will come of those.

1\. [https://en.wikipedia.org/wiki/New_Thought](https://en.wikipedia.org/wiki/New_Thought)

2\. [https://en.wikipedia.org/wiki/As_a_Man_Thinketh](https://en.wikipedia.org/wiki/As_a_Man_Thinketh)

<comment><USER9> I'm happy to see the intellectual history of this subject discussed in a cautious way.

The New Age contrast between scarcity and abundance is compelling when applied to the question of adapting to changed circumstances. (Take for example the link posted in the last day or two about people raised in poverty finding it difficult to regulate their food intake.) The New Age arguments boil down to a simple diagnosis that we have been conditioned, by scarcity, into habits that are no longer appropriate.

There was a Wired article about 7 years ago which discussed this contrast from another angle. In that article, like the original link under discussion here, the Scarcity mindset is caricatured as mean and rigid. The Abundance mindset is healthy and open to alternatives. It's not at all about "manifesting" abundance out of nowhere, as per The Secret. I think Stephen Covey might be a major source for the Wired version of the polarity.

From the Wired article "When scarce resources become abundant, smart people treat them differently, exploiting them rather than conserving them. It feels wrong, but done right it can change the world.

The problem is that abundant resources, like computing power, are too often treated as scarce."

Hard to disagree with that.

[http://www.wired.com/2009/06/mf-freer/](http://www.wired.com/2009/06/mf- freer/)

</comment></comment></comment><comment><USER10> _Called Paths to Power, it emphasizes the importance of neutrality: The world is not fair or unfair. It simply is. The more you can suspend judgment, the more you can learn and grow your power._

Not to be cynical about this approach, but having studied some of these concepts from a Mahayana Buddhist perspective, the idea of utilizing the perspective of Beginner's Mind to "grow your power" is a gross misappropriation and misunderstanding of the entire framework. In fact, within the traditions that originally conceived of these approaches, attachment to power, fame, and/or wealth is seen as the root cause of suffering and mental disenfranchisement and the very conceptualization that is to be let go [0].

Perhaps I need to look into this course a bit more to understand their approach but it seems that this is right in line with what many Buddhist scholars have worried - i.e., that these ancient traditions will be misunderstood and reformed in a way that may have wholly unhealthy effects on those who practice it.

[0] [https://en.wikipedia.org/wiki/Four_Noble_Truths#Second_truth...](https://en.wikipedia.org/wiki/Four_Noble_Truths#Second_truth:_arising_or_origin_of_dukkha)

<comment><USER11> What if you use that power to help other beings, though?

<comment><USER12> Using your power, whatever it may be, to help others is one thing. Deliberately, actively, perhaps even desperately seeking more power to help more people is another. The first is a form of compassion. The other is a form of pride. Why do these others need your help? Have they asked for it? Are you seeking that power to help or because you like power? Lots of questions that muddy the water there.

There are certain things, like enlightenment, which naturally slip out of your grasp the moment you try to deliberately reach out for them.

<comment><USER13> What if there are easy paths to enlightenment and we just don't understand them yet?

This is one reason that very well established traditions make me nervous.

<comment><USER14> If you find it, please let us know before you reach the state of Nirvana.

<comment><USER15> Here's another path - a mixture of pride and compassion. One nirvana please.

</comment></comment></comment></comment></comment></comment><comment><USER16> > _The ideal attitude is what she calls Abundant Thinking_

When I see a marketable name for such things, I immediately know it's some BS mix-match of hogwash to sell to people in need.

And sure enough: "sought-after executive coach Katia Verresen, who counsels leaders at Facebook, Stanford, Airbnb, Twitter, and a number of prominent startups".

</comment><comment><USER17> These concepts also work really well for dating and relationships. If you approach girls with a scarcity mindset, you tend to be a lot more needy, insecure and generally feel like a victim.

If you approach girls with an abundance mentality, you're much less needy, more confident and you don't really care about the outcome. You're just there to learn about her, and if she's not interested, well, there's plenty of other girls that will be.

<comment><USER18> Or maybe if she isn't interested, she just isn't interested? If she was the last woman on earth and she wasn't interested in you would that make it somehow alright to keep approaching her?

I mean really, I get what you are saying here, but it comes dangerous close to a guy viewing women as a "resource" and saying that he behaves better when he views that resource as unlimited.

<comment><USER19> I think you are projecting onto the comment a bit.

If the usage of the word "scarcity" was what caught your eye (as an association with women being "resources"), it was simply pulled from the article, which labels the two contrasting types of thinking as "scarcity" and "abundance".

<comment><USER20> I think the real trick the top-level comment was trying to talk about is that you shouldn't think of women as a resource at all. It just kind of got framed as a resource thing because of the context you mentioned.

</comment></comment></comment></comment><comment><USER21> So she sells coaching to already successful and wealthy people that amounts to those banners they used to have around my elementary school that said "Attitude is a little thing that goes a long way"?

Hooray for snake oil.

</comment><comment><USER22> >>"Priming is engaging in any activity that boosts your emotional and mental energy ... [like] photos that make you happy." That's Asian cats from Instagram for me!

I'm usually a bit skeptical of bullet point advice like this as reading it always seem like self-evident truism; I think people have to really experience it in order to understand its proper depth. But I'm glad that self-compassion is mentioned here because it's not preached very often and prob less intuitive. When I realised about it in one eureka moment (I know!) almost immediately I could have more respect for myself and found it much easier to forgive personal flaws and mistakes. So if you ever find yourself kicking and loathing over something, do a mental "There, there" patting on your head! You'll begin to see life in a much more whimsical, Woody Allen way :)

<comment><USER23> Well, one should be fair to other people, and if possible friendly, right? Turns out oneself is a person, too :)

> _I have expressed my strong interest in the mass of the people; and this is > founded, not on their usefulness to the community, so much as on what they > are in themselves. Indeed every man, in every condition, is great. It is > only our own diseased sight which makes him little. A man is great as a man, > be he where or what he may. The grandeur of his nature turns to > insignificance all outward distinctions._

\-- William Ellery Channing

I think that can be extended to more than humans, maybe everything.

And hey, don't knock eureka moments, especially not your own! When I was 20 and late for work in the morning, I walked by a lawn with a bird on it who was looking for worms, and looked straight at me. I didn't think about it at all, but nodded and said good morning. Then I had to laugh at myself, then I thought about it, and I never quite saw animals the same way. Suddenly it seemed so obvious, of _course_ they're persons. Not ones who speak my language or care about my salutations, but still. I feel similarly about plants, central nervous system or not. I mean, it's not like I could tell you what I mean with "person" to begin with, where the cutoff point is, but something changed and it felt and feels right.

But compassion for animals and plants is easy, compassion for humans is trickier... and compassion* for oneself, that's the trickiest part, and as you said, the most often overlooked. It's like we understand just fine that we shouldn't dehumanize others, shouldn't hold grudges, not disappoint people or break promises, and so on, but simply affording ourselves that same respect and basic goodwill often eludes us, which we then compensate with all sorts of things which are far from both compassion and real confidence.

* which is a great way to put it.. self-love just doesn't have the same ring of understanding, patience etc. to it; like "loving Justing Bieber" and "having compassion for Justin Bieber" are two completely unrelated things.

</comment></comment><comment> awinter-py Famous counterexample to this is the stuff about crisis leadership from a few years ago:

[http://www.salon.com/2011/08/02/first_rate_madness_interview...](http://www.salon.com/2011/08/02/first_rate_madness_interview/)

This guy's thesis is that in tough times, mental illness is associated with leadership effectiveness. His examples are Lincoln and WT sherman. (the stats argument here ends up being pretty weak).

Bottom line -- it's really hard to grade heuristics unless you have enough knowledge to restrict the situations which may occur in the future (and if you do, it's no longer a heuristic).

</comment><comment><USER24> Why you shouldn't trust successful people's advice.. [https://www.youtube.com/watch?v=1k7jeQQdqPA](https://www.youtube.com/watch?v=1k7jeQQdqPA)

<comment><USER25> To me that video is not making the absolute claim that the clickbait title suggests (their words not yours of course). The actual video seems to suggest to the viewer to be wary of _only_ looking at the winning perspective and being subjected to survivorship bias. That is, there's nothing wrong with hearing advice from successful people, but make sure to get input from unsuccessful people as well to get a more complete picture.

<comment><USER24> True, I think in this case you could argue that the title is warranted as it is exceedingly common in our society to examine and emulate successful people whereas it is exceedingly uncommon to do the same for (or even be aware of the existence of) unsuccessful people

</comment></comment></comment><comment><USER26> The power of positive thinking has to be one of the most undervalued capital. I would really like to see if there are any counter examples to this thinking that have worked for others.

<comment><USER27> I've been called negative before. For good reason :)

I tend to see the problems with things. The stuff that is good enough, why spend time thinking about? Seems boring to me - it's already done, lets move on.

I actually somewhat don't like being labeled as "negative person" since the actual result in my thinking is usually very positive outcomes. I improve things and make them better. How could I do that if I didn't identify what is wrong with something? The new webapp you wrote for me might be 95% awesome, but I'm going to probably be immediately drawn to the 5% that sucks just by the nature of who I am and that's what I'll be focusing my energy on to improve.

This worked well for me in my personal life for some time. Identify bad habits, get rid of them. However it can be a grind and I think folks that think the way I do are much more prone to depression and negative feedback loops that result in isolation (largely out of perhaps a frustrated idealist point of view). That's when it get's dangerous.

As in all things in life I think it's about balance. As I get older, I absolutely see and believe in the power of positive thinking. I just think some people can take that a bit (or a lot) too far and use it as an excuse to delude themselves.

<comment><USER28> Yep. Haven't read, but you might like:Bright-sided: How Positive Thinking Is Undermining America [https://www.amazon.com/dp/0312658850/ref=cm_sw_r_other_awd_d...](https://www.amazon.com/dp/0312658850/ref=cm_sw_r_other_awd_dkRfxb5YS55X2)

</comment></comment></comment><comment><USER18> Dressed up Calvinism IMHO. You're poor? You just aren't tapping into the abundance of the universe.

<comment><USER14> That's not a tenet of Calvinism.

<comment><USER18> sure, but ascribing some sort of otherwordly virtue to people by virtue of their material success is. inverted Calvinism perhaps. Regardless, still taps into the weird part of the US psyche that has a Protestant work ethic that believes that everything is possible for everyone if they just work hard enough filtered through a sort of divine blessing (only this case it is dressed up in a New Age "tapping into the power of positive thinking schtick") -- in any case, it has the same outcome of blaming individuals for the structural circumstances they find themselves living in -- in one case, it is that you obviously weren't one of the chosen, in the mainstream meritocratic case, it's a more easy to digest "you just didn't work hard enough", in this case it is dressed back up with psuedo-religious trappingsabout how the universe wants you to succeed and you get back the energy you put out.

<comment><USER14> Inverted Calvinism isn't really Calvinism though, is it?

<comment><USER18> all goes back to the divine right of kings for me...

<comment><USER14> I guess you could call me a Calvinist, but I find Calvin's treatment of Severetus (burning him at the stake) appalling. I just think that he got a lot of what I believe about Scripture correct - the whole TULIP summarization of his theology I largely agree with.

I just don't think that properity was ever part of his beliefs - if anything Calvin has been accused of being a gruel eating killjoy...

<comment><USER18> so basically you believe God chose some people to go to hell, some people to go to heaven, there's nothing you can do to change that, and there's nothing you can do to lose that, without the part that the Elect are showered in riches here on earth.

<comment><USER18> chris_wot -- the HN algorithms keep from from responding to your post again, but I hope you don't think I was being sarcastic (I wasn't, I was just stating the bare minimum of how I understood your views). I don't believe in a Christian god (though I did for a long while) nor do I believe in heaven or hell (though I'm still probably less rational and more mystical than 95% of HN - but thanks for the nuanced response. I do admit that it is completely logical to take the view that we all have free will yet God exists outside time and space so knows everything that will happen so therefore of course predestination and free will are not at odds with each other. I'd urge you to reflect on how an all-loving being could condemn anyone to torture for all eternity based on the decisions they made in one tiny lifetime, but that's neither here nor there. We're getting far afield of the main topic here, but I hope you would admit that prosperity HAS been a tenant of mainstream Calvinism in so far as god showering his elect on earth with blessings, etc.

<comment><USER14> Not at all - I knew exactly what you were saying and I didn't think it was sarcastic. I also wasn't offended, you basically summed up a lot of Calvanism (and rather starkly but accurately summed up my view on it!), and there was no real sugar coating of it. I respect that.

To be honest, when I read about the Prosperity Gospel, it's so far away from the New Testament gospels I have read a few times now that I just frankly don't understand it at all. I mean, in the gospel of Matthew, Jesus is reported to have said "Do not store up for yourselves treasures on earth, where moths and vermin destroy, and where thieves break in and steal. But store up for yourselves treasures in heaven, where moths and vermin do not destroy, and where thieves do not break in and steal. For where your treasure is, there your heart will be also."

I've definitely grappled with the concept of hell and damnation. It's not the appropriate forum to really discuss this in too much detail, suffice it to say that I think a perfect, loving God who is rejected and wronged by a creation made in His own image (with all that entails) because that creation needed to be given the freedom to accept or reject it's creator must give that creation a response.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER29> It sounds like a self improvement system built on top of this:

[http://www.telegraph.co.uk/technology/3304496/Be-lucky- its-a...](http://www.telegraph.co.uk/technology/3304496/Be-lucky-its-an-easy- skill-to-learn.html)

</comment><comment><USER30> That table layout is really bad on a large screen, at some point there's a nice max for a font and I really don't need giant fonts or text as images. That image is gigantic [1]. And that header hiding animation is so annoying. Why do you do this. :(

[1] [https://s3.amazonaws.com/marquee-test- akiaisur2rgicbmpehea/W...](https://s3.amazonaws.com/marquee-test- akiaisur2rgicbmpehea/Wzqzlm1ITymebh6BLin3_Screen%20Shot%202016-04-19%20at%208.04.33%20AM.png)

<comment><USER31> Unfortunately, this appears to be the trend. With mobile/tablet driving ad revenue growth, desktop visitors appear to be on their way to being an ignored/forgotten segment.

Fortunately, a quick hop into dev tools fixes the problem. For the primary paragraph content, switching from the current 22px down to 16px makes this read so much easier.

</comment></comment><comment><USER32> I think the most important thing about this kind of advice is not to generalize it. For some people it works and for some people it doesn't work. There is no self-help advice that works for everybody.

Also: The advice given is not complete. The people who have success with this do the things the article describes, but they also do some important things the article doesn't describe.

</comment><comment><USER33> Hand-wavy garbage. In my mind, there are only three things that matter when it comes to business success: Company reputation, ability to deliver and who you know. Everything else is either not important or fits under one of those tenets.

</comment><comment><USER34> some people produce more benefit half-sleep than thirty-five of those who appear to be awake. I'll pass on 'abundant thinking'...

</comment><comment><USER35> The author clearly doesn't practice abundant thinking, as the title should be "The Advantages of Abundant Thinking".</comment>


SVG2JSX – Convert SVG to Valid React SVG - <AUTHOR> http://svg2jsx.herokuapp.com <comment><USER2> The site would be much better if it loaded a sample SVG by default so I don't have to hunt down the source for an SVG that I have lying around (or on the internet).

<comment><AUTHOR> It is on my TODO list, probably will release tomorrow.

<comment><USER3> You could consider linking this up with open clip art.

</comment></comment></comment><comment><USER4> React is such a nice way to make SVGs generally. My team was building a microservices to generate our dynamic images, then had the realization: our frontend is React, and we can make these images client-side as inline SVGs (or server side if we need using the same code).

There's some browser compatibility issues we have to stay on top of, but overall it's been a blast.

<comment><USER5> I just started doing this for a project at work. It works amazingly well. I ended building a react designer to handle loading and creating new elements so that we can create images on the web versus converting an existing SVG from an illistrator file.

</comment></comment><comment><USER6> For anyone who looked at the repository linked from the Heroku app and was confused as to how this works (or indeed the extent of what it does), the actual transformation is being done server-side, using this: [https://github.com/balajmarius/svg-to- jsx/blob/master/index....](https://github.com/balajmarius/svg-to- jsx/blob/master/index.js) (from the same author).

</comment><comment><USER7> Related: Babel transform to load SVGs as React components: [https://github.com/jhamlet/svg-react-loader](https://github.com/jhamlet/svg- react-loader)

<comment><USER8> Upvoted, but it's actually a webpack loader not a babel transform.

</comment></comment><comment><USER9> I'm curious: what's the main use-case for this functionality?

Particularly given it's a lossy transformation, I can't think of any situation where I'd use this.

<comment><USER10> seems to just change double quotes to single. find and replace. I don't notice any other difference.

oh, noticed `0.5` turn into `.5` and `black` turn into `#000`. not sure how that will make it more JSX compatible

<comment><USER11> >oh, noticed `0.5` turn into `.5` and `black` turn into `#000`. not sure how that will make it more JSX compatible

That's for minimizing code size. In both of your examples one byte is shaved off.

Arguably this is a case of premature optimization though. For production, the Closure compiler will do a far better job at it. For development, you won't notice the difference of shaving off a few kilobytes.

</comment></comment></comment><comment><USER12> I have not yet tried this OP's tool, but I've been using something similar ([http://svg-jsx.patmoody.com/](http://svg-jsx.patmoody.com/)) and I'm very happy with the utility. Next time I need to inline SVG in react I will use this one.

</comment><comment><USER13> Slight aside: what are the performance impacts here? I've been wondering for a while whether JSX is a little dangerous in that it makes repeated, huge, nested calls to React.createElement() look like plaintext.

For example, I could easily just run element.innerHTML = "<svg...>" to add SVG content to my page. If the SVG isn't being dynamically updated, doesn't making JSX like this incur a large and unnecessary overhead?

</comment><comment><USER14> Does anyone know why the page try to load the url "[https://localhost:9000/sockjs- node/info?t=1493857220633"](https://localhost:9000/sockjs- node/info?t=1493857220633") ?

<comment><USER15> Probably some sort of live reload functionality for development

</comment></comment><comment><USER16> Is `xmlns` actually required? We've pulled it out of all of our React svg's and everything seems to work fine. Does anyone know of any quirks this could be causing?

<comment><USER17> It depends, if you're delivering stand alone SVGs (as opposed to inlined in some html) then browsers may not render the graphic properly without it.

</comment></comment><comment><USER18> check out [https://www.npmjs.com/package/react-icon- loader](https://www.npmjs.com/package/react-icon-loader) \- converts svg to stateless component with svgo optimizations

</comment><comment><USER19> I thought parens around any SVG would make it valid JSX.

<comment><USER20> You have to escape some portions, like CSS, (otherwise { and } will be interpreted as JS expression interpolation) remove xml namespaces, `class` also needs to be renamed to `className`, among other tweaks.</comment></comment>


Ask HN:  Do you look at who wrote a comment before you read it? - <AUTHOR>

Just curious.  It seemed like some people pay a lot of attention to who comes and goes.  Really the only time I look at the author of a post is if they mention specifics about what they do or if there's a back and forth gong on. <comment><USER2> I do quite a bit.

Since I visit here every day I get to know the styles and personalities of other frequent posters, I have seen many comments by them, and seen a lot of their blogs.

This adds to the conversation, since I can often tell why usernames I recognize argue in a certain way.

I also often remember previous discussions I've had with certain users. This is a good thing, since I know the intellectual integrity of a user I recognize when a back-and-forth dicussion ensues.

</comment><comment><USER3> I rarely look at the names unless it's an extended conversation and I want to make sure I'm still talking to the same person.

The usernames on this site are very small and inconspicuous. I take that as a sign that HN wants us to focus on the content of the message rather than the author. When I'm on sites which place more visual emphasis on the author (names in big fonts, avatars, etc), then I always notice who writes comments.</comment>


Our Universe is too vast for even the most imaginative sci-fi - <AUTHOR> https://aeon.co/ideas/our-universe-is-too-vast-for-even-the-most-imaginative-sci-fi <comment><USER2> Reminds this Yudkowsky's quote from a good article:

"Graham's number is far beyond my ability to grasp. I can describe it, but I cannot properly appreciate it. (Perhaps Graham can appreciate it, having written a mathematical proof that uses it.) This number is far larger than most people's conception of infinity. I know that it was larger than mine. ... "

[http://www.mrob.com/pub/math/largenum-4.html#superclass](http://www.mrob.com/pub/math/largenum-4.html#superclass)</comment>


Bloomberg U.S. Startups Barometer - <AUTHOR> https://www.bloomberg.com/graphics/startup-barometer/ <comment><USER2> I'm pretty sure the market is turning. I'm seeing more stories on TC about companies shutting down than starting up.

Rich people are starting to hold their cash in anticipation of a market dropout so they have reserves to buy up cheap assets.

<comment><USER3> There graph shows a market correction back to mid-2018 levels.

I'm not sure what caused the dramatic boost in 2019, but that spike appears to be more of an anomaly than a trend.

<comment><USER4> Without knowing the causes, I wouldn't be confident concluding that it's simply a correction to 2018 levels. But yes, it's also not worth the panic just yet.

</comment></comment></comment><comment><USER4> What events correspond to the recent peaks in the chart? It looks like the VC world was spooked around the start of December and nothing has changed its mind ever since.

Given these are startups, I would expect much of the information to be private, but it seems highly unlikely this is a complete black box.

Edit: The comments below raise good possibilities. My own (very naïve) research yielded that there was a sharp dip in the the overnight repurchase agreements at the start of December and a small rise a month later. I don't think this is the cause, and I'm probably biased by media narrative more than anything, but it might lead somewhere assuming there's a connection by way of the amount of easy money floating around. The EFF rate also dropped around 24th of July and hasn't gone back up [2].

[1] [https://fred.stlouisfed.org/series/RPONTSYD](https://fred.stlouisfed.org/series/RPONTSYD) [2] [https://fred.stlouisfed.org/series/DFF](https://fred.stlouisfed.org/series/DFF)

<comment><USER5> China Trade War: [https://www.seattlebusinessmag.com/finance/how-trumps- trade-...](https://www.seattlebusinessmag.com/finance/how-trumps-trade-war- china-will-affect-us-investment-markets)

Vision Fund Round 1 End: [https://news.crunchbase.com/news/the-vision-fund- era-is-near...](https://news.crunchbase.com/news/the-vision-fund-era-is- nearly-over/)

</comment></comment><comment><USER6> # of deals and # of first financings seem to be in a normal dec-feb drop period, but I think the overall index is driven by insane amounts of money per deal that peaked in june last year, making it look like a scary situation if you look at the index alone. Taking the parts one-by-one this is looking quite healthy

I wouldn't be surprised if the boom in deal amount was in turn driven by a small number of crazy large deals, assuming softbank, which given some big implosions last year has sobered up the amount given per deal. Again, this points to a healthier, more sustainable outlook since there are obvious longterm downsides to overinvesting in unicorns that can't possibly deliver.

</comment><comment><USER7> Vision Fund 1 from Softbank is at the end of it's lifecycle, now they still try to raise for Vision Fund 2. You spend much more in the early phases of a fund, so it's big enough to make all the difference here.

</comment><comment><USER8> Hopefully the drop is from less people taking VC money.

<comment><USER9> Why would that drop precipitously? It might vary a bit, but up up up then bang?

</comment></comment><comment><USER10> Someone please overlay that with a Bitcoin price chart

<comment><USER11> perhaps thats what the over supply of startups was in 2018

<comment><USER12> There _were_ a ton of crypto startups around that time...haven't seen any press from them since, with the exclusion of Coinbase, which seems to be doing well.

</comment></comment></comment><comment><USER13> The end is nigh.

<comment><USER14> What are you short?</comment></comment>


Ridllr - Bringing sharing back to Reader - <AUTHOR> http://www.ridllr.com/?source=hn <comment><USER2> Site is slowing down... From the main page: How does Ridllr work?

When you authorize Ridllr to access your Google Reader account, it downloads a list of other Google Reader accounts that you follow. For each of those accounts, Ridllr subscribes you directly to the public feed URL of that user's old shared feeds. All of these public feeds that you follow are amalgamated into one folder "People you follow", which appears in your reader subscriptions panel.

This allows you to see old shared content, but that's obviously insufficient -- we need to be able to allow you to continue to share new stuff with your friends. In order to do this, Ridllr creates a public tag called "Shared Items". Any item that you tag with this tag gets added to a public feed. Ridllr automatically subscribes everyone who follows you to this stream, and adds it to their "People you follow" folders. That way, your friends can still see what you've shared. Using your credentials, Ridllr thus ensures you are always subscribed to the shared items from all your friends who also use Ridllr.

</comment><comment><USER3> Learn to spell bro what the hell is ridllr

</comment><comment><USER2> Cool, nice work!</comment>


Microsoft vows Windows 7 will fix Vista mistakes - <AUTHOR> http://www.infoworld.com/article/08/10/28/Microsoft_vows_Windows_7_will_fix_Vista_mistakes_1.html

<comment><USER2> I just cannot believe that Microsoft has gotten 15+ years of mileage out of the "Just wait, the NEXT version of Windows is going to be great!" pitchline.

Every time a new version of Windows is about to come out we get this great line about how Microsoft has finally gotten their act together and released a real OS.

I don't mean this as a Windows-bashing post, but, c'mon, we've heard all this before.

</comment><comment><USER3> Vista broke many XP applications, and customers (particularly enterprises with legacy software) avoided this by not upgrading. Now Windows 7 will be compatible...with Vista, not XP. This doesn't really fix Vista's mistakes: customers who didn't upgrade are once again faced with having stuff break when upgrading Windows.

I'm not saying change is bad, but why is Microsoft unable to grasp the idea of virtualizing legacy (especially with proven examples of this, such as Apple's Classic environment?). There is absolutely no reason to cause countless customer applications to break, much less to make them _pay for the privilege of upgrading_. Microsoft jeopardizes their revenues by again making Windows upgrades risky for businesses.

<comment><USER4> Yet, legacy support is a factor of the bloat.

</comment></comment><comment><USER5> ... and make a bunch of new ones.</comment>


Ask HN: What are red flags/dealbreakers you look for when interviewing for jobs? - <AUTHOR> Most people are familiar with the "Joel Test". Ideally, companies are able to check most of the boxes on that list.
On the flip side, what would a list of "dealbreakers" look like? i.e. if a company checks 8 items or more on the list, it's probably not a good opportunity? <comment><USER2> As a front-end developer I always like to try and ask questions about the UX team/process. I don't like working on teams where design and UX have too much authority and use waterfall practices.

<comment><AUTHOR> How do you define "too much authority", and what are the questions that allow you to find that out?

</comment></comment><comment><USER3> \- windows \- dress code</comment>


The sorry state of Indian IT industry - <AUTHOR> https://www.youtube.com/watch?v=ztLGnpvsC2M#t=346

<comment><USER2> You get what you pay for.</comment>