MIT is a national treasure - <AUTHOR> http://cdixon.posterous.com/mit-is-a-national-treasure <comment><USER2> Honestly speaking, if he played around on an Apple II, this happened almost 30 years ago when the computer industry was still brand-new. Not to denigrate him, his achievements, or MIT, but the world _is_ different now.

It's an awesome anecdote, and I am a big fan of MIT, but consider this my preemptive counter-argument to the inevitable, "Here, see, more proof of why you should drop out of high school!"

(though, after all's said and done, I do hope MIT is not _too_ different from the MIT that accepted him back then)

<comment><USER3> I'm only 25 yet I taught myself how to program on an Apple //e in elementary and middle schools. Furthermore, today's computing environments are arguably _less_ conducive to autodidactism. When the Apple II booted it dropped you at a BASIC prompt.

<comment><USER4> I don't think I can agree.

I'm 29 and learned BASIC on an Apple II. While remembering what it was like makes me nostalgic for simpler times, I don't kid myself. It sucked.

I had to read out of scrappy library copies of Byte and Compute magazine. There were hours of trial and error. And worst of all, it all went away when you turned off the machine unless you had one of those notoriously unreliable tape machines.

Contrast that to my first experiences with Linux nearly a decade later. I had man pages, Usenet, IRC, and the web; better hardware, an operating system, developer tools, and free compilers! I learned about Perl and dynamic languages (I was into C at the time). I slowly started learning about how operating systems worked. It was a far more conducive environment for learning.

All of this information was right there on the computer. No more trudging down to the library or throwing away my money on thick technical manuals and trial- version compilers.

I'd say modern FOSS computing environments are the most conducive to learning. The Apple II was a toy compared to what we have now.

<comment><USER5> And, when you booted into GNU/Linux, you also had a web browser, chat programs, games, etc. The possibilities for distractions are numerous. Contrast that to a BASIC prompt. If you go to your computer to learn BASIC, as long as you are sitting in front of the computer and actively staring at it, you're either going to:

        a) get bored as hell by doing nothing
        b) type some stuff in from your magazine and execute
            (thereby learning "something" along the way because of
            typos, pattern recognition, etc. (of course you'll /then/ get
            distracted, but you had to work a bit)
        c) write a program from scratch by exploration, or need.

<comment><USER6> If anyone wants to try something that approximates a computer that boots into a BASIC prompt, try AVR programming or Arduino. It's either C or assembler and you've got to use mainly reference manuals. Arduino has more resources and thus may be more prone to distraction.

<comment><USER7> Either of these require programming on a computer with web-browser, games, chat, etc. Programming embedded hardware does not solve the problem of working in a distracting environment. Self-discipline, determination, and perhaps other inner qualities are necessary and always have been.

</comment></comment></comment></comment></comment></comment><comment><USER8> Speaking as someone who applied for MIT a few years ago, something like this is no longer possible and the "rat race" description used for comparision is now in fact valid for MIT as well.

Nowhere in the recrutation process you have much possiblity to show your "software code" - everything is very formalized and you have to submit your grades, essays on specified topics, pass the SATs and go through a interview (but the interviewer doesn't have to know anything about the discipline you want to study). Yes, you can describe your most interesting projects as part of your application, but if you read the admission blogs and other MIT materials, it is quite clearly implied that unless you have near-perfect grades and/or near-perfect SAT scores, they won't even look at the project descriptions, essays etc. Also there is no way of knowing why you were accepted or rejected, because the whole proccess is 100% opaque to the outside world.

I still think the MIT is awesome and the admission process probably has to look more or less like it looks like because of the volume of applications they have to go through. But the post and some of the comments seem to leave the impression that the MIT addmission comitee will look at every person as a "unique snowflake" to find the really outstanding candidates. In reality, the admission process has to be quite mechanical so that they can at all manage it and only after the initial 90% of the applications gets rejected, they can be scrutinize the remaining 10% in more detail. So, if you want to get-in, you have to "optimize grades and SAT" and "speaking French and Chinese, playing piano and painting abstract art" won't hurt either.

<comment><USER9> Bullshit.

They have the application process. You can ignore it. I did. I had shit grades in high school (not shit-by-MIT-standards, but actual shit). I took no time to do homework, and instead spent time reading math books and programming. By the time I applied, I had done research at a reputable university laboratory (although I did not get to the point of publishing), and had a good recommendation from a well-known professor there. I had also taken several advanced math classes at a state school.

I sent MIT a custom admission packet. I filled out their paperwork for biographical information, but mostly ignored it.

MIT rejected me early admission. I called to ask why. They told me that they liked my packet, but given my grades, they were concerned about my maturity and my ability to work hard. I got an extra recommendation from a professor teaching the math class I was taking, whom I had asked to explicitly let them know that I was mature and a hardworker. At that point, MIT took me.

I didn't even bother applying to Princeton, Harvard, Stanford, and the like, since I knew I had no chance.

Optimizing for grades is a bad and stupid strategy. If you're late in the game (high school), it's the only strategy with a chance of success. If you're circa elementary school, the best strategy is to ignore school. The time with no homework will let you learn math and science (which you can do much more quickly than school will teach you), and to have real accomplishments by the time you apply.

Real accomplishments ALWAYS trump grades, for anything, be it university admissions, jobs, or YCombinator. Grades are a proxy to see whether you are smart and can do useful things. Accomplishments are a direct measure.

<comment><USER10> > I took no time to do homework, and instead spent time reading math books and > programming

vs.

>I got an extra recommendation from a professor teaching the math class I was taking, whom I had asked to explicitly let them know that I was mature and a hardworker...

These statements are irreconcilable. A hard worker does work that he/she is assigned, and does not make pre-mature value judgements on the worthiness of said work. Being smart does not mean you're a hard worker. That was a pretty irresponsible recommendation by the professor, considering you didn't exhibit the qualities you claimed to.

<comment><USER11> > A hard worker does work that he/she is assigned

Maybe. But a smart worker evaluates what's important and what's not. Formal education and learning are sometimes completely orthogonal to each other. You might be thinking "well, how do you know what's important?" and the answer is that it's a gamble and decisions like those are not for everyone. There is no virtue in simply doing what you're told and being passive in your own education.

<comment><USER10> The OP claimed that he procured a reference that attested to his "hard- workingness". It's perfectly ok to be a smart worker, and I don't disagree with your point. My point of contention is with the abuse of the reference system - what value does the reference system have if you simply ask for (and receive) character attributes you do not possess?

So basically he was admitted on traditional merit, by misleading application reviewers.

<comment><USER11> Yeah I guess it depends how you define "hard work". Certainly spending hours reading math books and programming is some sort of work.

</comment></comment></comment></comment></comment></comment><comment><USER12> Ed Fredkin has a somewhat more impressive story. He became an MIT professor without ever getting a degree — even an undergraduate degree. But by that point he'd invented a fundamental data structure (the radix tree or "trie"), worked at MIT for years on defense contracts, and made enough money off a high-tech startup to buy a small island in the Caribbean. Not metaphorically. He actually bought the island. He'd also been teaching at MIT for some time.

He's at CMU now.

</comment><comment><USER13> "he never got he never got a high school degree"

This sentence tripped me up. I vividly remember some of the more boring classes where you end up staring at the clock, for some subjects I actually tried to put in the least effort possible to achieve 80%. I wish I had those years back to do follow something I really enjoyed doing.

<comment><USER14> It tripped me up too, but for the (to me more obvious) reason that the "he never got" is repeated.

Does that make sense to everyone but me? Or am I just being silly/obnoxious for complaining about (what I think is) an editing error in an article with an actual point?

Or is meant like "he never understood that he never got a high school degree"? I'm not a native speaker of English, and the missing "that" in the linked-to article makes this interpretation feel unlikely to me.

Confusing.

</comment></comment><comment><USER15> This is the problem that I had when I was applying to colleges: I used to ignore classes that bored me but were required and instead spent time that should have been spent on homework, etc. doing programming side projects and learning CS concepts.

When application season rolled around, I had to compete with candidates who had a much shallow understanding of their area of study, but had a much stronger overall GPA, loads of random APs, etc. While I did mention my side projects and depth in my area of interest, I didn't think to submit code or the actual projects; I usually just mentioned it in the questions or essays (which I'm not certain anyone even reads). This lead to quite a few rejections.

I'm at Georgia Tech now and doing well, because all my classes, more or less, are related to what I'm interested in. While I'm very happy here, I'm curious if I would be as happy if I _wasn't_ accepted to Tech, and were instead studying in a place without such abundance of opportunity. I'm sure there are others in similar situations.

<comment><USER16> If you have talent, and work hard to cultivate it, then you can take advantage of the opportunities that are around you. Doesn't matter if you're at GA Tech or MIT, there are always more good opportunities than good people.

<comment><USER15> I definitely agree; it's just a matter of finding the right people.

Anecdote: attending some of the tech talks that companies give at Tech, there is always a gradient of people, from the people that are there for free food to the people that are there to ask questions and get something out of it. These tech talks are thinly veiled recruiting events, and the latter set of people are always approached afterwards for interviews or networking purposes.

</comment></comment></comment><comment><USER17> This is rare, but not unheard of; I can think of fiveish people off the top of my head that were admitted to MIT and Caltech without a high school diploma. All of the cases I know of are kids who just decided to leave high school without finishing their requirements, and went directly into one of the tech schools a year early.

The blog post mentions that there 'was no place nearby to go to high school.' That's really the issue in play. All of the 'MIT a year early' people I know about made a case to admissions that they had exhausted all of the resources at their schools and the time for MIT was now. The tech schools don't discriminate against lack of opportunity. If you're perceived as not taking all of the opportunities presented to you, though, you're finished. The post mentions that he took some community college classes. This shows a desire to learn and an ability to take advantage of the resources available to him. If he hadn't gotten a high school diploma because he was just too cool to be bothered, I imagine that he would have had more of an uphill battle.

</comment><comment><USER18> While this is fascinating let's not forget that other people are NOT like Tom. Education is important and we shouldn't dismiss it if we have an opportunity to take it.

</comment><comment><USER19> Philip Greenspun also entered MIT after dropping out of high school.

<comment><USER20> I honestly believe our education systems(those that I know about) most of the time end up keeping some of the best people behind.

The idea of degrees and diplomas where everything is depends on scores achieved in a set of examination is utterly counter productive in my opinion.

I hate it when I see people worrying about grades without understanding what those grades actually mean.

<comment><USER21> The vast majority of the "best people" cruise through our education systems. The few who truly don't fit the mold usually end up making it if they are genuinely exemplary. Low caliber people then hide behind these few outliers to try to rationalize their own lack of ability and academic mediocrity. "I suck at everything but I know I'm smart cuz <famous_person> also didn't like school." Everybody wants a medal. And when they don't get one, they blame everything but themselves.

</comment></comment></comment><comment><USER22> It's not so unusual, I was accepted into my Computer Science MSc (at Oxford) without a CS background - I did have a first class BA, but it was a joint honours in IT and Philosophy from a more-or-less unknown university (Lampeter).

Anyone who knows CS will know that IT is nothing like CS. I didn't have any A-Levels either. Masters degrees are a lot more forgiving, and I had some experience in software engineering.

(edit: this was year of 2009, and yes, I passed ;0) )

<comment><USER23> I don't know if this applies to the course you did but there used to be a lot of "conversion course" MSc courses in CS related areas in the UK.

These were very much targeted at people who did _not_ have a background in CS.

<comment><USER22> yeah I think those courses do still exist, mine was a straight-up MSc though.

</comment></comment></comment><comment><USER24> The submitted blog post acclaims MIT as a "national treasure" because it admits applicants to its undergraduate degree programs who don't have a high school diploma (certificate of completion of secondary schooling). MIT is not alone in this policy. The Common Data Set Initiative

<http://www.commondataset.org/>

surveys United States colleges and universities each year about their admission policies. Question C3 asks if a high school diploma is required for undergraduate admission.

Harvard

[http://www.provost.harvard.edu/institutional_research/Provos...](http://www.provost.harvard.edu/institutional_research/Provost_- _CDS2008_2009_Harvard_for_Web_Clean.pdf)

does not require a high school diploma for admission.

Neither does Princeton.

[http://registrar.princeton.edu/university_enrollment_sta/com...](http://registrar.princeton.edu/university_enrollment_sta/common_cds2010.pdf)

Nor does Yale require a high school diploma.

<http://www.yale.edu/oir/cds.pdf>

MIT has long reported that it does not require a high school diploma for admission.

<http://web.mit.edu/ir/cds/2010/c.html>

[http://www.mitadmissions.org/topics/qanda/questions_and_answ...](http://www.mitadmissions.org/topics/qanda/questions_and_answers/bens_seventh_semiannual_qa.shtml)

There are other colleges that explicitly say in their Common Data Set filings that they do not require a high school diploma for admission. Moreover, homeschooling is widespread in around the world,

<http://learninfreedom.org/homeschool_growth.html>

and all of the most famous and most desired colleges and universities have admitted homeschoolers,

<http://learninfreedom.org/colleges_4_hmsc.html>

who often have "home brew" transcripts (as my oldest son did when he applied for his undergraduate university studies last year).

Lacking a high school diploma issued by a government-operated school is not a barrier to admission to any of the better colleges or universities in the United States, if the applicant is well prepared for higher education study.

After edit: I'm amazed that this thread has not yet mentioned pg's essay "What You'll Wish You'd Known,"

<http://paulgraham.com/hs.html>

his advice to high school students about how to use their time meaningfully. High school students who take this advice to heart can get into a good college with good financial support if they want to, or pursue some other challenging personal goal if they would rather do that.

<comment><USER25> I don't think the point is whether the schools require a high school diploma as a stated prerequisite; it's more whether they actually admit people with no diploma on the basis of other work.

<comment><USER26> Many / most schools admit people with no diploma on the basis of their work. This is why many students apply as Juniors in high school and how early admission works. If universities required a high school diploma as a qualification, students wouldn't be able to apply until they actually completed high school. There are many cases of people entering college as early as 13 years old, and this is not limited to MIT.

<comment><USER27> Early admission has nothing to do with having a diploma. All undergraduate and graduate programs let you apply before you have finished the previous level because the application and acceptance process takes more than the time between schools.

In cases where diplomas are required, the acceptance letter will always contain language stating that they will retract your acceptance if your grades drop an unacceptable amount or you don't finish the degree you're working on. Then most schools require you to submit another set of transcripts, proof of graduation, etc. before you officially enroll.

</comment></comment></comment></comment><comment><USER28> MIT is a national treasure because of this: <http://ocw.mit.edu/index.htm>

OpenCourseWare is absolutely amazing. I'm using it to study SICP and then will continue with K&R. I didn't go to MIT, but I'll always feel indebted to it because of these amazing resources.

</comment><comment><AUTHOR> Although arguably implied, there is nothing in this blog post that explicitly states that MIT is alone amongst institutions of higher learning in accepting a student without a HS diploma. Rather, it is simply demonstrating a particular example of just such an unusual occasion.

I'm not sure why everyone is reading into it so much: it's just a "feel good" piece, really, illustrating how one student's practical skill set -- here, coding -- was sufficiently talented to warrant a second look by one of the country's (best) universities. And, being a private school, they were willing (and able) to peel back their own red tape and allow admission notwithstanding his otherwise disqualifying credentials.

The point of the story is simply: here's a kid who was unqualified in the traditional, technical sense. But due to his obvious skill and intelligence in a particular field, a private school was willing to look past his technical disqualifications and, by its own prerogative, make an exception to its own rules.

This is most certainly why Berkeley and other public schools were unwilling to make an exception: they have less flexibility. (As someone who attended UCLA, I can attest personally to the stringent red tape of California's public university system.) That the blog throws public and private schools into the discussion demonstrates a remarkably cavalier oversight that misses the point entirely with respect to why, precisely, MIT -- a private school -- is the school that happened to grant the student the exception.

</comment><comment><USER26> Once again, the title of the post and content overstate / misstate a point and belie the reality. Many high school students apply to schools like MIT without having a degree -- they get the degree when they actually graduate, by which time they have already been accepted or denied admission by schools like MIT. Speaking as an MIT graduate, and one that was accepted early as part of the early admission process, not once did they ask in the application or in person whether or not I already had a high school degree. Of course I didn't - I'd get one when I graduated. When I applied, I was still a Junior. and I applied early. All I needed were my SAT scores, a transcript (which the person in the article had as well), and evidence of excellence.

I don't understand the point of articles like this that breathlessly trump one thing while the reality is something else. Colleges everywhere regularly accept people that have not yet completed high school. This is not just MIT. To say that MIT is somehow unique here misses the point. And yes, I know, because I went to MIT.

</comment><comment><USER29> My friend Ryan Lackey also got into MIT without a high school diploma at 16 (<http://en.wikipedia.org/wiki/Ryan_Lackey>). He later dropped out to become the CTO of Sealand.

</comment><comment><USER30> To all the comments here - I don't think Chris is making a point against schooling. He's sort of implicitly making a point against resume padding.

Resume padding is not a healthy thing and such examples could enlighten a lot of high school students.

<comment><USER31> I think another way of looking at this is in parallel with Ben Horowitz's dictum, in the context of hiring, to look for strength rather than lack of weakness. I think in school admissions or hiring, there's a trade-off in the end of trying to find the best people in terms of the most impressive lack of weakness in any area versus the most impressive strength in at least one area. The more bureaucratic the process becomes, the more it tends to favor screening for lack of weakness.

There's a corresponding tension on the candidate side in how to prioritize the record of accomplishment one seeks to develop to prepare for a desired school admission or job, in how much effort to devote to shoring up any potential weaknesses versus how much effort to devote to pursuing capabilities and accomplishments centered on one's core competency. Sometimes that choice might take the form of whether to procrastinate less consequential pursuits to focus all one's effort on the most important thing one knows of to work on at that time, and sometimes that neglect of other pursuits can make a difference not just in degree but in kind, like pg talks about in "Good and Bad Procrastination".

The danger is that all college admissions processes are becoming homogenized and over-bureaucratized to the point of excessively screening for lack of weakness, to the point of never fairly considering a candidate's record of profound intellectual accomplishment because all the right boxes on their record aren't checked off, and that students are calibrating their intellectual pursuits accordingly. The glory of MIT in this example is that it avoided that over-bureaucracy of the process at least in this instance.

Obviously you can say well, any really gifted student should devote all necessary effort to a well-rounded education and SAT prep and extra-curricular activities as well as develop clear accomplishments in a core interest, and should be able to do well at it all. There's always a trade-off at some point though; and I think many of the greatest intellectual accomplishments have come from people who didn't consistently devote large chunks of their schedule to a diverse portfolio of widely varying subjects and activities.

</comment></comment><comment><USER32> When I was a sophomore at the 'Tute I became friendly with a frosh who was a little different. He was from Texas (as I am, but that is not germane) and was 24. He had pledged the co-ed frat next door to my dorm where I used to hang out a bit, and always to play pool at their Friday happy hours. His father was a senior executive at a well-known semiconductor manufacturer.

He was certifiable on many levels, but a very interesting guy. He was working at Draper Labs within a month of his arrival on campus doing who-knows-what with some-unknown-level security clearance.

He had applied to MIT from a Texas state penitentiary where he was serving a six-year sentence for robbing a series of pharmacies and related misdeeds. Once he finished there, he started a different sort of prison. ;)

I recently submitted an application for the summer funding round as a sole founder. My one good friend who has been living JavaScript and CSS for the last few years is busy with his own company, but I am sure this is a good spot to meet potential partners. I call my idea StratoShare, and it involves a gateway for providing a uniform access API across users' data aggregations. The gateway would also manage a sharing graph for each user that would include those of their various aggregators, but would be independent of them. Share once with each other for everywhere, and manage it all in one view.

If you have some Web app chops and are interested at all, please email firstname.lastname@example.com and I'll send you a link to my application and video.

</comment><comment><USER33> After that story, there's no source code? It would be interesting to see, at the very least.

</comment><comment><USER34> Just goes to show you can still be successful without an MBA, a bachelor's, or a diploma. So many successful people missed some part of standard education so I guess we all should since those are the ones we keep on celebrating.

I can't tell if I'm being sarcastic or not...The idea is to avoid the typical route and focus on building and execution, where the real world is giving you a report card and not a school. If you're good enough, you'll get an honorary degree or be accepted without the standard credentials.

</comment><comment><USER35> I went to MIT without a high school diploma (and a few years early); I got a great score on the SAT standardized test, good recommendations from a couple of HS teachers, MIT summer camp grad student/professor instructors, and a hacker job I'd had (via the Internet).

I don't think HS is actually a major factor in the MIT undergraduate admissions decision if you have a plausible reason for wanting to skip it.

</comment><comment><USER31> Someone I know well was recruited on full scholarship to Cornell as a math student in 2007, even though he was a high school dropout.

<comment><USER36> There is some ridiculous story about how the guy who founded Burger King got into Cornell. Apparently the head of the mycology department had written some article 20 years earlier in a trade journal saying that anyone who did X, Y, and Z would get an automatic in to the university, and the guy came along and did these things even though he was otherwise completely unqualified.

</comment></comment><comment><USER37> In other news, one data point is enough.

</comment><comment><USER38> sounds impressive but this is a exception, not the norm

there are many areas where certification/practice needs prerequisite qualifications eg surgeon, attorney, airline pilot

if the course is highly competitive/lucrative like say with IIT or AIIMS in india, expect litigations

</comment><comment><USER39> While this story is awesome, it's really not that relevant today. During the Apple II days most programmers would have been self taught. Today, not so much.

</comment><comment><USER40> "Software code?" Really?

This is the sort of thing that could have happened during a very small slice of highly unusual history. It certainly wouldn't happen these days.

</comment><comment><USER41> the title should have been: "Student accepted to MIT without high school degree _thanks to_ his software code"

</comment><comment><USER42> MIT only enrolls geeks.

</comment><comment><USER43> Sounds like a modern Forrest Gump.

</comment><comment><USER44> Glaring typos in the third paragraph, with repeated phrases and bold text. Good story, though. Upvoted.

</comment><comment><USER45> This should be an eye opener for all those bookish/only SAT score people.</comment>


Ask HN: MVP using an off the shelf product? - <AUTHOR> Just curious to know if any of you built your MVP using an off the shelf product.
If you did were you successful?
For e.g.
Using discourse to start a community OR Word press to start a real estate brokerage page <comment><USER2> We started our business with a single static page, then multiple static pages. The pricing page basically said "email us", the contact page just had an email address. All account management was an off the shelf API management system we paid 25 USD/month. Everything was manual, new customers had to be added manual to a text file, we created and emailed invoices with MS Office. To see if there is a market and customer demand it's enough.

<comment><AUTHOR> How is your business doing now?

<comment><USER2> successful</comment></comment></comment>


More Instantization -- Bing Instant - <AUTHOR> http://binginstant.com/

<comment><AUTHOR> ...which seems to have gone down as soon as I submitted it.</comment>


Experiment on the effect of body-worn cameras on police use-of-force (2013) [pdf] - <AUTHOR> http://www.policefoundation.org/sites/g/files/g798246/f/201303/The%20Effect%20of%20Body-Worn%20Cameras%20on%20Police%20Use-of-Force.pdf <comment><USER2> There's a petition for officers to wear cameras on petitions.whitehouse.gov that's rapidly approaching the required signature count:

[https://petitions.whitehouse.gov/petition/mike-brown-law- req...](https://petitions.whitehouse.gov/petition/mike-brown-law-requires-all- state-county-and-local-police-wear-camera/8tlS5czf)

It will be interesting to see how some of the access / privacy details are worked out. For example, the mike Brown shooting happened on a public street, but what if it had happened in a private residence? Would the police recording be publicly available?

Edit: There are also innumerable instances of police providing damaged, incorrect, or no footage at all even of events that were filmed. The Ferguson police, after beating a handcuffed man in a jail cell and then charging him for destruction of property for getting blood on their uniforms (no link, easy to google), submitted jail footage that was a) 12x speed, rendering it useless, and b) of a different time than the incident. Simply capturing video is not enough, it must be stored and later provisioned by a 3rd party.

<comment><USER3> I'm no constitutional expert, but I'm having a hard time figuring out how the federal government could possibly have the authority this sort of law would require.

<comment><USER4> > I'm no constitutional expert, but I'm having a hard time figuring out how > the federal government could possibly have the authority this sort of law > would require.

Requirements to make and keep records which demonstrate compliance with legal restrictions are a routine and essential part of the enforceability of many laws, so, to the extent that the Constitution explicitly imposes restrictions on the States and explicitly authorizes Congress to enforce those restrictions through "appropriate legislation" (especially in light of the necessary and proper clause), Congressionally-imposed recordkeeping requirements to demonstrate compliance would seem to be within the scope of the Congressional power thus granted.

This is relevant because the 14th Amendment commands that "No State shall [...] deprive any person of life, liberty, or property, without due process of law; nor deny to any person within its jurisdiction the equal protection of the laws" and provides that "The Congress shall have power to enforce, by appropriate legislation, the provisions of this article".

Even with the way the Supreme Court has limited the authorization clause of the 14th Amendment to (unlike identical language elsewhere) only authorize _corrective_ legislation, so that it might not be possible for Congress to impose a general and unconditional requirement, Congress could still impose a requirement on _particular_ states as a consequences of past violation of Constitutional due process or equal protection occurring under the power of those states.

(It could also do it by making it a prerequisite for, say, federal law enforcement assistance funding, or access to federal law enforcement databases, etc. -- and it could do both in parallel, so it would be required _both_ for states found to have past violations for which it serves as a remedy, _and_ for states wishing to federal assistance for law enforcement.)

<comment><USER3> "(It could also do it by making it a prerequisite for, say, federal law enforcement assistance funding, or access to federal law enforcement databases, etc. -- and it could do both in parallel, so it would be required both for states found to have past violations for which it serves as a remedy, and for states wishing to federal assistance for law enforcement.)"

This is a much more likely to work approach (but not what the petition is asking for).

That said, the political realities of police cameras are going to make this a fight that will not be won on the federal level (especially not in the current environment where getting anything done seems to be seen as treason).

Local laws on the other hand could be easily implemented.

<comment><USER4> > This is a much more likely to work approach (but not what the petition is > asking for).

Petitions aren't generally detailed legislative proposals, and their relationship to concrete legislation is similar to the relation between the first draft of requirements for complex computing system and the concrete implementation.

> That said, the political realities of police cameras are going to make this > a fight that will not be won on the federal level

Probably not; OTOH, issues like this that make any progress are rarely pushed exclusively in one venue, and even if they aren't _won_ at the federal level, attention there can be a key factor in driving media attention to efforts and driving public awareness. (Plus, heck, the white house petition site has plenty of people petitioning for changes in policies of particular private corporations, so something that's a legitimate public policy issue where the federal government could plausibly do something close to what is requested, even if it would be exactly identical and is unlikely in the current political climate, is actually fairly reasonable.)

</comment></comment></comment></comment></comment><comment><USER5> The cops in my town wear cameras. I also happen to be a firefighter/paramedic in my town.

This has given me a reason to ponder these cameras quite a bit...

It's not uncommon for me to be in someone's house, while they are in some sort state that they would probably not want to have recorded (if someone is having a heart attack at 2 in the morning, they are not generally concerned about the fact that they sleep naked). Now you have a situation where a cop with a camera is walking into the room... Most folks don't even realize it's there (it's black, and blends in with their uniform pretty well).

Should the LEO disclose he's wearing a camera? "Hey, I notice you just fell in the shower and are naked, soaking wet, and in an awkward position. Just FYI... I'm wearing a camera."

This doesn't even begin to cover the HIPAA implications...

In general, I'm very much in favor of cameras on cops. I think it helps keep everyone on their best behavior in potentially confrontational situations. That being said... I have been in situations where the presence of the camera has made me very uncomfortable.

<comment><USER6> It's not like the police take the cameras, and immediately post them to youtube. If complaints are made, video can be reviewed by those who need to review it. If it needs to go to court, censoring can be added.

I do see your point. I would counter with: if we are to claim we're free to record the actions of the police while they work, surely they have the right to record what goes on as well.

<comment><USER5> Sure... my point is just that the issue is more complicated than it seems to be on the face of it...

Law enforcement officers end up coming into contact with everyday people in very compromising positions, often through no fault of their own, and in their own homes.

Like I said, I fall on the 'pro-camera' side of the debate, but there are a lot of often overlooked implications that I feel need to be part of the discussion.

<comment><USER7> I think you are in the weeds at this point.

<comment><USER5> Perhaps I am. I was simply trying to relate a personal experience with these cameras, and the fact that they have made me feel uncomfortable at times (for the sake of the folks I'm caring for). It seemed germane to the conversation.

Maybe someday it'll be routine enough that it doesn't enter my mind. For right now, it's frankly a bit of a distraction (in situations where a distraction can literally be fatal).

<comment><USER7> I understand that. The petitions state in intent of direction and action, I don't put much weight in specifics at this level. And in your case, there should be some exemptions for doctor patient privilege. You need the trust of the person you are serving to know how to treat them. If they mixed drugs or took a drug they didn't have a prescription for you need to know. But if they think the camera will testify against them, they won't seek the help they need.

This is why there should be a federal standard about the collection of signals. I would _absolutely_ like to know that when I see a camera on an officer that the event is being recorded and accessible during discovery later. Even if I don't know the officer in question and that the audio, video, etc won't be prevented from being archived or be altered. Cryptographic signatures and one way encryption are key in this regard.

The cameras should be treated as a trusted third party, not an optional tool under the purview of the officer. There should be a public ledger that is subject to review of who requested unencrypted access to recorded signals.

</comment></comment></comment></comment></comment></comment><comment><USER8> Relevant, from Schenier: [https://www.schneier.com/blog/archives/2014/04/police_disabl...](https://www.schneier.com/blog/archives/2014/04/police_disablin.html)

TL;DR - Voice recorders installed in police cars, and after a time it was found that a significant number of the recorders were missing or tampered with. Go figure.

Playing devils' advocate, though ... it's far too easy to criticize in hindsight what happens in a split second, both sides potentially fueled by a combination of fear and adrenaline.

<comment><USER9> One could just as easily say that about a great many crimes.

</comment></comment><comment><USER10> A simple law mandating that all officers wear body cams is probably not going to be all that effective. As another commentor mentioned, it's not real clear how this could be handled at the federal level. The threat of these cams being turned off is real and there will need to be laws to mete out punishment if it happens (which will be incredibly difficult.) All that being said, this is probably a good step in raising awareness of the usefulness of body cams.

[http://www.fox8live.com/story/26283883/officer-involved- in-m...](http://www.fox8live.com/story/26283883/officer-involved-in-monday- shooting-had-body-cam-turned-off)

</comment><comment><USER11> Url changed from [http://www.scribd.com/doc/130767873/Self-awareness-to- being-...](http://www.scribd.com/doc/130767873/Self-awareness-to-being- watched-and-socially-desirable-behavior-A-field-experiment-on-the-effect-of- body-worn-cameras-on-police-use-of-force).

A related article that fell through the cracks on HN last year: [http://www.nytimes.com/2013/04/07/business/wearable-video- ca...](http://www.nytimes.com/2013/04/07/business/wearable-video-cameras-for- police-officers.html?pagewanted=all).

</comment><comment><USER12> "Importantly, there are still somewhat similar cases taking place, despite efforts to stop such behavior through better training and prosecution of rogue officers."

Is this an Onion University study?

Anyway, seriously, while I love the idea of body worn cameras for police officers, in practice they are in control of whether the camera is recording or not, and tend to 'forget' to turn their cameras on more often than not.

<comment><USER13> I would think with current technology, an always-recording system could be put into place at a fairly low cost. Certainly an interesting idea for anyone looking for a new starup idea involving cameras and bullet proof vests.

<comment><USER2> Indeed. The Ferguson police in fact have a couple dashboard cameras and body cameras for officers to wear, however none have been installed due to the $3k/per expense (no link, easy to google).

It's staggering how low accountability is on law enforcement's priority list, especially given the amount of money available for "crowd control" military hardware.

<comment><USER14> > It's staggering how low accountability is on law enforcement's priority list

Huh? Why would they want to be accountable? Accountability would be a priority of the _populace_.

<comment><USER2> Priorities can be mandated. Dealing with externally-set priorities is a fairly regular subject on this very forum (damn you, marketing!).

No government agency should be solely responsible for selecting what is and is not its job.</comment></comment></comment></comment></comment>


Rails 4.2.3 and 4.1.12 have been released - <AUTHOR> http://weblog.rubyonrails.org/2015/6/26/Rails-4-2-3-and-4-1-12-have-been-released/

<comment><USER2> I really like that the Rails team is pretty good at doing regular releases. One noticeable thing though is that ActiveRecord, almost, always has more fixes than the other Action* gems combined, understandable since its the most complicated piece, but I can't help to think of Ernie Millers ActiveRecord talk a few years back. [https://youtu.be/yuh9COzp5voA](https://youtu.be/yuh9COzp5voA) (A few of the things that he talks about are since then fixed..)

<comment><USER3> Wow, this is a really great talk for anyone using rails. Ernie Miller manages to dissect a few gnarly parts of ActiveRecord while keeping it positive and constructive.

</comment></comment><comment><USER4> It's fascinating to watch the changing reception of a given framework. I think this says a lot about how software projects grow old. Since my career is only slightly older than Rails, it's been the framework that I've got to watch the most completely. I recall in 2005 and 2006 there was an intense joy in the tech industry, relating to Rails, and it seemed like Rails was going to sweep the industry. In retrospect, that joy was mostly because Rails offered something simpler than the heavyweight Java frameworks that had dominated the era before. In 2006 there was the big question, "Is it Rails we love, or the ideas in Rails?" That is, did we all need to start using Ruby, or could we copy these ideas in whatever language we preferred? And nowadays we know the answer to that question. In 2005 and 2006 Rails had a huge impact on the industry, but by now its good ideas have been fully absorbed by other tech communities.

For those who want to remember the mood of the times, circa 2005, Bruce Eckel did a great job of capturing it in his December 2005 essay "The departure of the hyper-enthusiasts":

[http://www.artima.com/weblogs/viewpost.jsp?thread=141312](http://www.artima.com/weblogs/viewpost.jsp?thread=141312)

He was lamenting/celebrating the sudden end of the hype around Java.

</comment><comment><USER5> Is Rails relevant today in the world of rich front end frameworks other than for legacy applications? I used to be a big fan of Rails but there is a steep learning curve and looks like there are better alternatives now.

<comment><USER6> Is there a steep learning curve? Admittedly, I haven't had to pick up too many new frameworks, but I would have thought Rails was easier to pick up than many others.

<comment><USER7> I just started learning it this week and it isn't bad... However, there's quite a bit of setup, and it's a bit tricky at first.

Basically, a few years ago I thought it was easier to build my own framework in Golang, C, C++. I've also used PHP, Node and Flask from time to time. After doing all that, I had a pretty good understanding in how it all works, and can see the beauty in some of the way Rails works. I definitely think it'll keep growing and is worth learning if you're into web development.</comment></comment></comment>


GraphQL concepts I wish someone explained to me a year ago - <AUTHOR> https://medium.com/naresh-bhatia/graphql-concepts-i-wish-someone-explained-to-me-a-year-ago-514d5b3c0eab <comment><AUTHOR> Struggling to apply GraphQL to real projects? I did too.

In a recent blog article, npmjs co-founder @seldo commented that GraphQL will be a technical force to reckon with in 2019. He says there's a good chance you'll be using it in new projects.

I'd like to share the concepts (like scaling subscriptions) I learned the hard way. You'll notice I'm using a realistic example that has multiple entities and relationships. And it's relationships that cause us heartburn.

I'll be releasing one part a day for the next week (in case you'd like some holiday travel reading). Here's what you can look forward to.

Part 1: GraphQL Basics

Part 2: Queries (server implementation)

Part 3: Queries (client implementation)

Part 4: Mutations (server implementation)

Part 5: Mutations (client implementation)

Part 6: Subscriptions (server implementation)

Part 7: Subscriptions (client implementation)

What have you struggled with in GraphQL? I'd love to hear your stories and make it easier to get started.</comment>


Gnome starts campaign to protect its trademarks - <AUTHOR> https://www.gnome.org/news/2014/11/gnome-starts-campaign-to-protect-its-trademarks/

<comment><USER2> I work in the same building as the groupon world headquarters, 600 W Chicago Ave.

Is there anything I could give them (not trolling, but seriously) in their office on the 3rd and 6th floor?

<comment><AUTHOR> Quite an intriguing offer. We've got a few ideas. Contact us at firstname.lastname@example.com and let's talk.

</comment></comment><comment><AUTHOR> I'm one of the folks working on this campaign; happy to answer any questions people might have.

<comment><USER3> Any chance of adding Stripe/Bitcoin payments? I'd rather not support PayPal.

<comment><AUTHOR> We do have it set up so that you don't need a PayPal account to donate; we're currently using PayPal for credit card processing, not just PayPal account- based donations.

Regarding bitcoin, see [https://mail.gnome.org/archives/foundation- list/2014-May/msg...](https://mail.gnome.org/archives/foundation- list/2014-May/msg00079.html) for details, sorry.</comment></comment></comment>


Ask HN: Back end architecture design for site that aggregates data across APIs - <AUTHOR> Hi HN!
I run a little statistics website for World of Warcraft: subcreation.net (source at https://github.com/alcaras/mplus.subcreation.net)
I'm working on updating this site and am wondering how I should re-architect my backend to to minimize costs.
Current architecture is: - Some script queries APIs -- writes data to DB. Ideally rate limited / queues so I am a good citizen an obey api limits. (I am using App Engine Task Queues but these are of course deprecated and not available for Python 3 ... and Cloud Tasks are more work to set up). - Then some script that, when data gathering is complete, generates HTML / JSON files and writes it to somewhere the web server can read it. - Users visit and view HTML pages.
Current set-up: Google App Engine runs tasks to query APIs, write to Datastore, and then output HTML to Cloud Storage. Strangely,  egress costs are the highest expense -- on order of $20/month for something like 300 GB outbound (~30k MAU), which seems egregiously high(!) to me.
Not sure as to NoSQL vs SQL -- I seem to be dealing with reasonably structured data but originally opted for DataStore over CloudSQL since DataStore was cheaper.
Wondering how to do this more cost effectively.
1. App Engine + Cloud Firestore + Cloud Storage
This is effectively updating the current architecture, but moving to Python3 and Cloud Firestore. Could write static json to Cloud Storage to enable fancy filtering as well.
2. Shared VPS + Python + MongoD / Sqlite
Not crazy about dealing with server admin, but this seems cheaper, since VPSes seem to have much cheaper egress.
3. AWS? Azure? Other options?
Appreciate any thoughts / ideas :) I am currently leaning toward option #1, but am wondering if exploring #2 would be better from a cost-basis, since my main user facing interaction is static HTML pages (or, if I make the site more interactive) HTML pages with AJAX to static json files. <comment><USER2> Re option #2, we have found Linode's smallest offering, Nanode, to be remarkably useful for a bunch of tasks that sound similar to yours (and indeed some bigger tasks). Only $5/month, which includes 1TB of transfer, and easy enough to switch to bigger plans if needed.</comment>


Software Patents Have Got to Go - <AUTHOR> http://www.pcmag.com/article2/0,2817,2374861,00.asp?kc=PCRSS03079TX1K0000585

<comment><USER2> Not just software patents, but intellectual "property" in general.

Boldrin & Levine: "Against Intellectual Monopoly" <http://www.dklevine.com/general/intellectual/against.htm>

<comment><USER3> 34 years after Bill Gates' open letter to the "pirates" and decades of heavy propaganda and legal actions from the BSA, RIAA, etc, the general public still isn't convinced that copying bits is wrong. If after decades trying you can't change people minds, it must be that you're wrong and they're right. Intellectual Property must die.

<comment><USER4> Just because the public wants something doesn't make it right.

<comment><USER5> The reality is that this is exactly how we as a species define "right": we do what we want to do, and eventually we invent justifications and frameworks to make what we already do the "right" thing.

Eventually, when enough people don't want to do something anymore, that becomes "wrong."

I'm not saying this is how it should rightly be, I'm just saying this is how it is.

I bet you eat animals that have been tortured and killed in factory farms, and you have a bunch of a really great justifications for that. QED.

<comment><USER6> >I bet you eat animals that have been tortured and killed in factory farms, and you have a bunch of a really great justifications for that. QED.

As a vegetarian I feel that bringing out this argument (implying that a particular person is hypocritical -- and yes, I understand the societally- approved point), in response to a discussion on copyright patents, is below the standard of discussion I expect from HN. In general this discussion seems to include a lot of "no it isn't" / "yes it is" type bickering without much substance, and to be honest I blame the original article, which was content- free. Up above we have people arguing for the abolition of all intellectual property, and others claiming that mob rule is the basis for democracy. I don't see why the issue is such a binary one. Clearly the patent system needs reform. It's not at all clear that it needs to disappear entirely.

</comment></comment></comment></comment></comment><comment><USER7> US patent law (as well as copyright law) derives from Article I section 8 of the Constitution which grants Congress the power "To promote the Progress of Science and useful Arts, by securing for limited Times to Authors and Inventors the exclusive Right to their respective Writings and Discoveries."

The question is do patents actually promote the progress of science and technology ? I suspect that they do not because while they create additional monetary incentives to pursue innovation at the same time they restrict the free flow of ideas which is the driving force behind scientific and technical progress.

The free exchange and use of information is probably the source of the exponential progress in "information technologies" that Ray Kurzweil has discovered. It seems likely that impediments to the exchange and use of information, such as patents, can only reduce the rate of exponential growth.

Perhaps if patents had never existed our technology would be far more advanced than it currently is.

If it were ever possible to prove conclusively that patents impede rather than promote progress, they would become unconstitutional in the US.

<comment><USER8> How do you think patents "restrict the free flow of ideas?"

A patent must publicize what is being claimed: you are given a explanation of the design or process. You just can't make it and sell it. However, by knowing someone's design, even when patented, it can inspire someone else to build something even better.

<comment><USER7> Well they clearly restrict the free use of ideas. An idea that I can't use is of limited interest to me.

Have you ever read a software patent ? The ones I have seen have been written in a very strange way (ie use of non-standard terminology for technical concepts) which seems aimed at obscuring the nature of the ideas being patented rather than clarifying them. If patent descriptions were really intended to convey useful technical information they would read more like journal articles rather than some strange dialect of American legalese.

I'm sure that some innovation occurs through efforts to work around existing patents however I doubt that effect comes close to matching their effect of preventing ideas, even if independently discovered, from being incorporated into new technical solutions.

As for the notion that people are going to read 20 year old expired patents for their ideas that seems pretty unlikely to me given the pace of technological development.

</comment></comment></comment><comment><USER9> This isn't anything new. Pretty much anyone who knows anything about software is against software patents except for a few with a vested interest.

The patent system was originally created to protect investment and foster innovation by providing exclusivity but requiring disclosure to further research by others and of course there is a time limit.

The problem is that ideas (which is what software patents and business models come down to) have next to no cost (unlike, say, new drugs that have substantial R&D costs, trials, etc).

Lawyers have gotten very good at perverting this system [1]. I remember reading about Intel's system bus (I think in relation to Nvidia producing chipsets without a license). Basically parts of the system were patented, some copyrighted and the rest was a trade secret. Combined it meant Intel basically didn't have to disclose anything but could still go after those who reverse engineer.

Once I used to support pharma-patents but I'm changing my mind on even that. I believe the high cost of health care in the US is in large part to the protections and monopolies suppliers have. The counterargument is that many of these things wouldn't exist without these protections but I think the pendulum has swung too far.

Something like two-thirds of the budget for a new drug goes on marketing [2].

Worse, we're starting to see copyright trolls [3] who are basically producing reams of crap in the hopes that someone inadvertently infringes on that so they can be sued.

So IP is horribly broken, not just for software.

[1]: [http://en.wikipedia.org/wiki/Software_patent#Overlap_with_co...](http://en.wikipedia.org/wiki/Software_patent#Overlap_with_copyright)

[2]: <http://en.wikipedia.org/wiki/Pharmaceutical_marketing>

[3]: <http://en.wikipedia.org/wiki/Copyright_troll>

<comment><USER10> As a biochemist, I can assure you that if pharma-patents went away, drug- development would disappear overnight. One can argue over the specifics, but some form of IP protection is necessary in that arena.

<comment><USER7> My understanding of the traditional drug development model is basically that companies spend millions of dollars testing large numbers of substances in vitro, then in animals then finally in human trials to find a very small number of drugs that work. Once such a drug has been found and approved by the FDA it is fairly trivial for a competitor to reproduce, which in the absence of patents, would allow the competitor to essentially appropriate all the R&D the initial developer did.

This development model is extremely different from that seen in software and related technologies where many small ideas are combined to form compelling technological solutions. I suspect this difference in development models is the main reason for the much slower (linear) progress seen in medicine compared to information technologies (exponential). I also suspect that as our understanding of biological systems improves, the pharmaceutical industry will evolve towards a more information based development model.

In any case, it seems to me that in the present, IP policy needs to accept that different industries have different development models and that a one size fits all IP policy is not a good solution.

</comment></comment></comment><comment><USER11> The instant I saw it was John Dvorak I closed the tab.

<comment><USER12> I can understand this reaction, but even a crazy pundit can be right twice a day.

<comment><USER13> But is it worth the time and trouble of figuring out whether _this_ time it is worth reading? I have a whole list of websites and people mounted on the wall over my monitor who have been so outrageously incompetent in the past that I avoid reading them. If they have shown such a low quality of accuracy on things I do know about, there is no way I can trust them on things I don't already know, so there is _no point_ to reading them. (Note I only do this for actual _facts_ that were flagrantly wrong, I read a lot of opinions that I disagree with.)

</comment></comment></comment><comment><USER14> > Basically, Allen got an omnibus patent that covers all these characteristics

No. He didn't. And regardless of whether software patents need to go, ignorant media coverage certainly needs to go.

<comment><USER15> Most people, including myself, cannot actually read patents. Being told that the summary is irrelevant does not help at all. What are we supposed to do, ignore the patent because we don't understand it?

<comment><USER8> If you're a programmer, you can read software patents.

If you're a mechanical engineer, you can read mechanical patents,

If you're a farmer, you can read farming patents.

See how that works? The language is dense, and you must read carefully, but the patents I have actually read are not particularly difficult to understand.

<comment><USER16> > If you're a programmer, you can read software patents.

Here I can bring in a different definition of "can". I could if I wanted browse different software patents, but that just puts me or my company in more legal trouble especially if sometime later I happen to develop something similar enough to a patent I've previously read that I get sued over it. It's not a good idea to just read patents blindly if you have any interest in building stuff that might get popular.

Though I suppose it's probably safe to read the Linked List patent, which is one of the clearest and silliest I've ever seen: [http://www.google.com/patents?id=Szh4AAAAEBAJ&printsec=a...](http://www.google.com/patents?id=Szh4AAAAEBAJ&printsec=abstract#v=onepage&q&f=false)

</comment></comment></comment></comment><comment><USER17> It's depressing to see a respected and influential software industry icon resorting to patent trolling like this. I expect it from lawyers and corporate-raider types, but was surprised to see Paul Allen doing it.

To cherry pick a quote from Dvorak's article: Paul Allen says he has a patent for a "Browser for Use in Navigating a Body of Information...".

On the other hand, corporations love a monopoly, and I guess Paul Allen wants to be involved in another one.

<comment><USER18> How likely is Paul Allen doing this as an attempt to weaken software patents? MS is trying the SCOTUS in an effort to make it more difficult to assert claims. Wonder if this might be part of the same strategic play. Doubtful, I know.

<comment><USER19> Very unlikely. He targeted everyone but Gates. His attack is legitimate.

However Allen can feel just, I guess, given that he has dedicated most his wealth to charity after he dies. So he's essentially playing Robin Hood.

</comment></comment></comment><comment><USER16> I flagged this since we don't need a new one of these articles every day...

</comment><comment><USER20> Now that's what I'm talking about!

Patents were originally intended to encourage investors in a time when bringing a product to market could take years.

In the software industry, that assumption is, to put it mildly, totally off. Therefore, in the software industry, granting someone a 17 year monopoly on an idea just encourages another, destructive type of strategy that hurts the entire industry: PATENT TROLLING.

Seriously, it is a legal strategy to describe something to the government, wait a few years and then go after the people who actually BUILT IT (even if they came up with it independently, as long as they can't prove they came up with it before you described it in a patent application).

That's BULL CRAP. You didn't do anything except write some paper. If you're good at it, you don't even need a lawyer. And you get to collect money from the hard work of others.

On the other hand, I feel that if you DID write a patent, AND you tried to make it work, AND you are succeeding, you SHOULD be able to prevent your competitors from just copying what you did. But not for 17 years. For two years at most!

It is in this latter sense that the patent system is great. I'd get a provisional patent over an NDA anyday. Because it's more legally enforceable. Say a company meets with me and I tell them the idea. First of all I don't have to require them to sign any NDA. Secondly, suppose they say, "nice idea, we are going to do it ourselves". I can tell them, "I have a provisional patent, and I will sue your ass in 2 years." Or I can tell them NOTHING, go ahead and convert it to a real patent (probably $5k out of my pocket) and go sue them 2 years later. Not 17 years later.

This, I don't mind. They wanted to screw me by stealing my idea, they got burned. This will encourage companies to NOT screw individual investors and actually decide if they want to wait 3 years before making this, or work with the inventor.

With NDAs, there is no way to prove anything. I spoke to Bobby, and they signed an NDA. Then, Charlie Inc. comes out with my product. I didn't make Charlie, Inc. sign anything, and Bobby doesn't have the $5 million dollars to pay me, and I can't prove he told anything to Charlie, Inc. OOPS.

That's what software patents should protect against. That's it. They currently do, but we don't need 17 years of that kind of protection!

</comment><comment><USER21> Software Patents should be allowed, however the rules on them need to be heavily modified so that the real spirit of the patent can reward resourceful hard working innovators.

Patents were meant to protect programmer, however since programmers tend to work for big businesses and the big businesses absorb all the rights to the code, the software patent is only protecting businesses. I propose a change.

Software patents should have timeouts that increase and decrease depending on the amount of genuine innovative breakthrough contained in the code. If I make a new website that does something people like that never has been done before, then I get so many cents for anyone else using it for so many weeks (something like this would need to be strictly enforced).

Now suppose some programmer created a new bit of software that takes Human DNA as input and outputs a list of instructions on how to reverse aging on that version of the human genome. In this case the software patent would be Longer, with more of a payoff for others who copied it and used it inside the time frame.

Software Patenting isn't evil, it was meant to protect US, the programmers, it is just a completely broken system so that it isn't helping at all.

<comment><USER22> > Software Patenting isn't evil

Except that it is.

<comment><USER23> [Citation needed]</comment></comment></comment>


Why is it so hard to swat a fly? - <AUTHOR> http://www.bbc.co.uk/news/science-environment-41284065 <comment><USER3> As someone who works in visual neuroscience, this article's a tough read. Lots of statements that are semi-accurate at best.

1) Eyes don't work like cameras; there's no real "exposure" phase as such (even though there's lots of thresholds). So it's misleading to talk about discrete images that we sample at some fixed frequency. Instead, it's much more helpful to think of photoreceptors and subsequent processing stages as continuous band-pass filters. At some point, high frequencies are simply cut off because the electro-chemistry of the cell can't keep up. For us, that cut- off comes earlier than it does for invertebrates.

2) There's no mechanical interaction between light and photoreceptor. Instead, the transduction cascade of the dipteran eye seems to encompass a mechanical (as opposed to biochemical) step.

3) It's pure conjecture to talk about a fly's slowed down "perception" of the world. The reason why they take off before you get to them is much simpler -- there's a highly optimized reflex that connects eye and flight muscles via the giant fiber (a particularly rapid nerve). We have similar responses, like eye lid closing etc. Additionally, their photoreceptors are sensitive and fast. But there's zero evidence that flies have any sense of continuous time that could be faster than ours.

Ah, well. The perils of science journalism.

<comment><USER4> Thanks for the informed opinion. I know way less about animal vision than machine vision but the statement that eyes have a "frame rate" and "send images to the brain a fixed number of times a second" smelled really bad.

A maybe-dumb question about point (3) - I've noticed that when I get a blink/flinch response from something (usually some sand or a bug hitting my face when I'm on the bike), it _feels like_ I blink just a split second _before_ the thing hit me. Given that I'm unlikely to have any kind of precognition, do you think this might be related to the blink reflex being 'hard wired' and so my brain gets the "hey, a thing hit your face" signal after the "hey, your eyes just closed" signal? (Alternately, I read something once about our perception of audio being delayed by ~100ms so that it synchs up with our perception of vision, despite our visual processing being slower than audio - maybe the signal that caused the flinch gets 'buffered'?)

<comment><USER3> > I've noticed that when I get a blink/flinch response from > something > (usually some sand or a bug hitting my face when > I'm on the bike), it > feels like I blink just a split second > before the thing hit me.

We know very little about conscious perception or even the locus at which sensory signals are integrated to generate a conscious percept. But it's perfectly possible that delays differ across modalities and that the proprioceptive signal about lid-closing reaches whatever-relevant-area before your visual system catches up.

> I read something once about our perception of audio being > delayed by > ~100ms so that it synchs up with our perception > of vision

Not an expert on audition, but the brain is really good at generating coherent representations of the physical world across modalities. I wouldn't be surprised if such cross-sensory synchronisation happened in some form.

<comment><USER4> Cool, thanks for the response! I'm glad my theory doesn't sound /too/ far fetched. :)

</comment></comment></comment></comment><comment><USER5> If you want to catch a stationary fly, it's pretty easy to do so with your bare hands. The key thing to know is that they jump _backward_ before taking flight.

Aim for a spot about 1-2" behind the fly, and about 1-2" above the fly. Try to catch it _there_ , and your success percentage will be high.

<comment><USER6> The perspective of cathing a fly that walked on crap five minutes ago disgusts me. I know they cleanse their paws more often than I do mine, but faugh.

<comment><USER5> 1) catch a fly and wash your hands

2) see the fly walk over your food, your face, your kids food...

Do you want to touch a "dirty" fly, or eat what the fly has walked on?

I'll take #1 any day.

<comment><USER7> 3) Do not care at all, and consider that our bodies are pretty well tuned to handle such thing as a few particles of foreign excrement (or other dirty things).

Seriously, we have become irrational animals afraid of everything. (I would wash my hand after splashing a fly if there was a rotten corpse around, though, and would have done even without the fly because my nose would have alerted me of a chemical danger.)

</comment></comment></comment></comment><comment><USER8> Three techniques: 1\. Move your open hand towards the fly very slowly until you are 5cm (2 in) away then slap. 2\. Move both hands slowly towards the fly and "clap" to catch it. 3\. Blow gently downwards onto the fly, then slowly increase the force of the blowing. You might then be able to pin its wing to the surface.

Yes, I have a lot of time on my hands.

<comment><USER9> _> Yes, I have a lot of time on my hands._

Also a lot of fly goo.

</comment></comment><comment> j-conn Check out the "bug-a-salt" salt gun. With good aim it's more effective and fun than a flyswatter. Absurdly, amazon wouldn't ship to California but you can buy from [https://bugasalt.com](https://bugasalt.com)

When swatting, I've found they can only fly forward and had good success anticipating that movement. Apparently others in this thread can catch them on the fly's initial backwards jump, which I had never noticed.

<comment><USER10> These are fun but I found them incredibly hard to aim; for me, the Bug-a-salt was only effective when less than two feet away from the fly. (And the fly had to be stationary -- no dramatic mid-air takedowns.)

</comment></comment><comment><USER11> Where's the video of the killer fly catching a fruit fly? I want to see _that_.

<comment><USER12> Also, what is the scientific name of the killer fly? There is no such article on wikipedia.

And some more references on how compount eyes see _mechanically_ , as opposed to chemically, would be interesting.

<comment><USER13> [https://en.wikipedia.org/wiki/Asilidae](https://en.wikipedia.org/wiki/Asilidae) maybe this one, although this video explicitly names killer fly: [https://www.youtube.com/watch?v=ukiTGsvFP1Y](https://www.youtube.com/watch?v=ukiTGsvFP1Y)

</comment></comment></comment><comment><USER14> I have perfected this. I can even stop them mid-flight.

Spray at it with any liquid (e.g. water, household cleaner). It may take a couple of squirts but it's easy as it doesn't need to be exact. The fly will fall to the ground where you can just squash it with a tissue.

<comment><USER15> A more high-tech solution: [https://www.aliexpress.com/item/1pcs-Hot- Worldwide-Electric-...](https://www.aliexpress.com/item/1pcs-Hot-Worldwide- Electric-Insect-Fly-Mosquito-Zapper-Swatter-Killer-3-Net-Racket- Rechargeable/32316697946.html)

<comment><USER14> Have one of those. They don't work.

<comment><USER15> Must be bugs in firmware

</comment></comment></comment></comment><comment><USER16> It's really easy to pick up flies with a hose attachment on a vacuum.

Every once in a while we get a number of flies in the house during the summer when the doors and windows are open. They tend to gather in the sides of our windows, looking for a way out. I used to catch them one by one, and then I tried a vacuum. It was easy, once they are aware of the vacuum it's too late to fly away, and they get sucked right up. It's probably not worth while for one or two flies, but if you're going after a few a vacuum can be really effective.

</comment><comment><USER17> Only partially related to this topic, but is anyone else driven crazy by the Cadillac taillights? I haven't talked to anyone else who is, but I can identify one from a mile away at night. It's like the refresh rate is just low enough that it flashes and it drives me nuts.

</comment><comment><USER18> And why are flies found in the country significantly harder to swat than those you find in the city?

</comment><comment><USER19> Because it's much more important for a fly not be swatted than for a large animal to swat it.

</comment><comment><USER20> Differences in visual flicker-fusion rate between species is interesting. But I think it's a bit presumptuous to claim that time drags by 4x more slowly in a fly's reality, and that's why it can usually escape a giant hand falling from the sky. The fly escapes because it's quicker than you. It would probably be just fine if could detect motion at 60 Hz.

</comment><comment><USER21> Man you guys just approaching the problem the wrong way. I'll tell you how Mike D, a technitian at Apple taught me. You simply wait for the fly to land, and then come at it from behind. The flys launch backwards when they take off, so you can open hand catch them, perform the stun, and get them out of the lab with all your open hardware.

I'll never forget seeing Mike catch that fly.

</comment><comment><USER22> I really never had a problem catching flies and I don't even think I have fast reactions. You just need to observe their flight silently for a few moments, breathe subtly and make your move suddenly, preferably from the back. They are amazing at avoiding hits from the front. Put yourself in the mindset of a deadly, stalking predator instead of irritated house resident and watch those kill counts stack up.

</comment><comment><USER23> After reading these comments, I'm starting to wonder if I'm the only one who owns an old-fashioned flyswatter. With a long, stiff handle and a flick of the wrist, it moves a lot faster than a fly. I've even stunned them by hitting them in mid-air.

</comment><comment><USER24> I've found it much easier to try and hit the fly mid air with one open palm, rather than crushing it against a surface. If you hit it, it will be fall to the floor dizzy/stunned. From there just pick it up with a piece of paper.

</comment><comment><USER25> The article doesn't mention this but as I understand flies can only see motion. So when you move very slow you can catch them.

It doesn't mean that they only see moving objects by the way. In flight they see because everything is moving around them.

<comment><USER12> I thought that most (all?) eyes only see motion, just as you do not feel the weight of your clothes anymore (or the presence/absense of your wallet in your back pocket) after a while. But reading up on microsaccades[1] - <USER2> involuntary eye movements which I thought fixed that in mammals - that does not seem to be the current understanding anymore.

1: [https://en.wikipedia.org/wiki/Microsaccade](https://en.wikipedia.org/wiki/Microsaccade)

</comment></comment><comment><USER26> You will notice that flies do not generally flee from things swaying (plants branches, curtains) in the wind, if you make a sway movement with your swatting implement the fly will ignore you when your too close for it to escape.

<comment><USER27> ... when _you 're_ too close ...

</comment></comment><comment><USER28> I keep my hand vertical when approaching the fly and turn it only when accelerating for the swat. That way the approaching hand appears with less dramatic increase in size which allows a quick approach without warning the fly.

</comment><comment><USER29> It's super easy with an electric fly swatter - it's like a small tennis racket which kills on contact. They might see it with their super fast vision but the racket is just too large for them to avoid m

</comment><comment><USER30> In my experience flies have much harder time avoiding a finger flick.

<comment><USER9> Yes. Bring the hand close _very_ slowly, forefinger cocked... then....pow.

Other techniques I've employed: (1) cling film (saran wrap), (2) detergent spray (slows em down; dispatch after 2-4 rounds), (3) vacuum cleaner nozzle (they hunker down but are sucked in upon take-off)

<comment><USER27> What do you do with cling film?

<comment><USER9> Slow approach with a sheet 20-30cm wide held at opposite edges by both hands. The film being transparent the fly sometimes doesn't notice it. Also a convenient means of disposal.

</comment></comment></comment></comment><comment><USER31> Anecdote: I find that towel snapping works well.

</comment><comment><USER32> not trying to be that guy, but I swat the fly dead 9/10 times. Mr Miyagi did also train me, but I don't use the chopsticks like my moderated compardre above.

</comment><comment><USER33> Want to kill the fly with your hands, clap above it

</comment><comment><USER34> after watching karate kid, i now catch flies exclusively with chopsticks. i'm 3,285 for 3,285!

<comment><USER35> Please respect HN's rules for on-topic discussion.</comment></comment>


New Amazon CloudFront Feature: Default Root Object - <AUTHOR> http://aws.typepad.com/aws/2010/08/new-amazon-cloudfront-feature-default-root-object.html

<comment><USER2> This is pretty exciting stuff, you can build static sites with S3 now.

<comment><USER3> Agreed: coupled with CNAMEs (so you can map www.mydomain.com to the Cloudfront servers), this is an excitingly scalable new hosting option.

But: Cloudfront still won't gzip transparently, which for a static site means you're stuck either with excess load times or with hacky JS workarounds. If and when they sort this out I'll switch from Rackspace's Cloudfiles in an instant.</comment></comment>


CIA hacking unit failed to protect its systems, allowing Vault 7 disclosure - <AUTHOR> https://www.washingtonpost.com/national-security/elite-cia-unit-that-developed-hacking-tools-failed-to-secure-its-own-systems-allowing-massive-leak-an-internal-report-found/2020/06/15/502e3456-ae9d-11ea-8f56-63f38c990077_story.html <comment><USER2> This happens in many corporations as well. It's fun and exciting to be on the red-team (doing the penetration testing, writing exploits, etc) but the blue team (infrastructure teams and developer teams hardening things) is not only boring to most, but it's also the team that gets the most grief from developers for inducing friction. If your company has a red team, ask how big the blue team is and if they have the same freedom to develop and implement mitigating controls as the red team has to exploit things.

Hacker competitions mirror this. Red teams are allowed to bring in any exploits and do just about anything (as criminals would be expected to do) and the blue team are stifled by bureaucracy and not allowed to bring in anything.

<comment><USER3> Hacker competitions often seem very contrived to me. I suspect that in order for the red team to make any progress you have to tie the blue teams hands behind their backs. Most of what I see from the penetration testing community is pretty gimmicky and situational generally and often doesn't take into account the attackers risk/reward ratio.

<comment><USER4> What would be a less gimmicky setup?

<comment><USER5> Allowing Blue Team to fight back maybe? Or to be able to actively track the red team instead, using an active defense, instead of only passive defense?

Moreover, the outcomes are different for both teams:

\- RedTeam success => they are seen as "real" hackers/heros and the BlueTeam are the poor incompetent

\- RedTeam fail => the BlueTeam did "only" its job, the investments in cybersec for the company paid off... so the budget for the cybersec can be reduced.

So, for RedTeam, it's either a win or a tie. And for BlueTeam it's either a tie or a loss...

If the BlueTeam could fight back, maybe this could change...

<comment><USER3> That's good. Perhaps something like if they can attribute the attack to a particular machine the red team gets "arrested".

<comment><USER6> Do the feds still attend DC? >:}

<comment><USER7> No and they don't come because hackers asked them not to. >:/

<comment><USER8> Found the Fed.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Words can't describe how normal that is. Exploit tools are require local systems to be super open in order to be frictionless.

Even in the consumer industry; anyone remember all those very silly people who installed backtrack2 (precursor to kali, based on slackware not debian) to their main drive and then went to defcon and got rekt because their OS was insecure (and couldn't be updated!)

Exploit development is a glass cannon, remove all friction to modify the system and craft packets, invoke monitoring modes for hardware and frictionless tracing... that's going to have a security cost.

This echo's a wider issue in the industry "Development" vs "Sysadmin" mindsets, where sysadmins are stifling and developers are all about removing barriers to progress faster and iterate more.

<comment><USER10> What's the story re: backtrack2, for the uninformed?

<comment><USER9> I'm trying to find a citation here, but it's difficult because "Backtrack 2 ssh exploit defcon" is going to produce a lot of content which is unrelated.

Anyway I can give you the skinny of the situation:

1) Backtrack 2 did not have an installer, it was a live-CD. But that doesn't stop you installing it by just copying the live environment to a disk (with some mount-binding and grub install, you're all good!) There were guides for doing this although they all had large warnings and the backtrack maintainers cautioned heavily against doing it.

2) because it was a liveCD there was no package update mechanism, it was not based on debian at the time so there was no apt or anything similar, even if there was there was no repositories, backtrack was a "tool" not a distro really.

3) sshd is one of the services that gets started on system boot for backtrack2.

4) someone at defcon unveilled an sshd exploit, a pretty nasty one, they had disclosed responsibly and everyone had been patched for at least 6 months, except the people who went against recommendations and installed backtrack2. They all got rooted.

Bonus: everyone who ran backtrack2, without exception, ran it with the root user; as that was the default and they had patched software that normally complains about such things to not complain. xD

<comment><USER11> >4) someone at defcon unveilled an sshd exploit, a pretty nasty one, they had disclosed responsibly and everyone had been patched for at least 6 months, except the people who went against recommendations and installed backtrack2. They all got rooted.

Yeah, I don't think this happened. Nobody has publicly exploited an opensshd rce for ages.

<comment><USER9> It may have been the kernel; frankly I'm fuzzy on the details I just remember the staunch warnings and feeling vindicated.

This was like 2007-8.

</comment></comment></comment></comment></comment><comment><USER12> The article tries to make it sound like the failure is a lack of prioritization and if they just focused correctly the problem could have been avoided, but I do not see why anybody would assume they would be able to protect their systems even if they tried.

How well protected do you think cyber-weapons designed to surveil countries, disable infrastructure, and destabilize governments should be? How capable and well-funded should the attacker need to be before gaining access to cyber- weapons designed to kill economies and people? $1B, $10B? A team of 1,000, 10,000?

Does anyone know of any system or organization in existence that would even be willing to claim they can stop a team of 1000 dedicated hackers working full- time for 10 years funded with $1B let alone put it in writing? What is the highest you have heard? Is it even in the general ballpark?

It is absurd to assume that the failure to solve the problem is just a lack of prioritization if no one even claims to be able to solve it and it is meaningless to propose that they should adopt policies that do not even claim to be able to protect against the actual threat model let alone have evidence of such protection. They either need to find someone who will make the extraordinary claim that they can provide an actual defense and have the extraordinary evidence to back up that extraordinary claim or they MUST NOT deploy such systems since they can not be protected.

<comment><USER13> Yeah I guess some people really misunderstood how hard making secure system is. Of course you can't claim to kill economy or too many people with it, but really you don't even need that kind of funding to break into most networks.

I guess it's safe to say that even with $1M of funding and small team of dedicated security researchers coupled with right people for social engineering you can break into any network. Everyone can be fooled and humans are always the weakest spot. Especially now when information about everyone is publicly available on social networks so you can gather all information you need remotely.

And when it's come to hacking into networks of company with no dedicated budget for cybersecurity cost of attack would be one or two orders of magnitude lower. Some self-organized groups of hobbyists prove you can even do it with no funding at all.

</comment></comment><comment><USER14> How does somebody exfiltrate 34 TERABYTES from a secure facility without getting noticed?

To misquote Dr. Strangelove, "ze whole point of ze secret hack is lost if you don't keep it a secret." [https://youtu.be/2yfXgu37iyI?t=205](https://youtu.be/2yfXgu37iyI?t=205)

Oh, maybe they have a firewall built on a RaspberryPi somebody ordered online.

Seriously, WTF? This is as insecure as having contract sysadmins with root privilege spread all over the globe.

And when will these state actors with unlimited funding figure out that NOBODY can keep secrets forever, not even them?

<comment><USER15> What are the tools to help orgs notice exfiltration?

<comment><USER16> Glossing over 10 years of tens of thousands of people's work, things like Titan Rain (1, 2) led to a lot of thinking about monitoring your production environment with things like the istio sidecar system.

(1) [https://en.wikipedia.org/wiki/Netwitness](https://en.wikipedia.org/wiki/Netwitness)

(2) [https://en.wikipedia.org/wiki/Shawn_Carpenter](https://en.wikipedia.org/wiki/Shawn_Carpenter)

</comment></comment></comment><comment><USER17> I saw a screenshot of a CNN article which said that that the CIA frequently used tactics to make hacks appear as though they were from Russia. Which is something I always suspected was relatively easy to do...change some logs, some timestamps, use some existing code...I'm not a hacker per se, but most of us write code here and deal with these kinds of things...

So does anything in this vault possibly call certain recent allegations of Russian interference into question?

<comment><USER18> The intelligence community's opinion that the DNC hack was done by Russia was based upon the single source of a private organization CrowdStrike. But given all the heavy hitting nation states regularly frame others, "Russia's fingerprints" can mean either they did it or they didn't, so it's functionally worthless.

<comment><USER19> That's completely untrue.

<comment><USER18> Shawn Henry said "We said that we had a high degree of confidence it was the Russian Government"

Sorry, but "high degree of confidence" is not proof, especially not from the organization that told us Iraq had WMDs with high degrees of confidence.

Additionally, at no point in time did they have access to the hardware.

Are you forgetting that this is the same collection of people responsible for being unable to secure their own hacking tools?

<comment><USER19> Skepticism of the claims of law enforcement and the intelligence community are good, for a multitude of reasons, but the case here is a lot stronger than you're suggesting and is substantiated by much more than mere finger-pointing by the US government or other governments.

It's unfortunate that the political climate in the US is on such a knife's edge right now that basically no one trusts anyone and everyone is running with their own databases of the facts of the world.

I understand the US government is itself very largely to blame for this deep distrust, but posts like yours make me worried for the next few decades. This isn't a criticism of you at all, but just general concern that things are kind of coming apart at the seams societally. I really hope the "two movies on one screen" phenomenon doesn't escalate to the point that the screen shatters into a billion pieces.

</comment></comment></comment></comment></comment><comment><USER20> [https://outline.com/6pySsH](https://outline.com/6pySsH)

</comment><comment><USER21> Reminds me of any "security" product. Next time you get the chance, I suggest you tear into any industry standard security tool and you'll be surprised at what you find.

</comment><comment><USER22> I find it ironic that the CIA didn't bother to have it's systems secured/verified by the NSA. I'm sure the CIA thought that they were good enough, coming from an organization that was infiltrated from its inception, their hubris isn't surprising.

<comment><USER2> My limited understanding is that these orgs compete with each other for budget allocation and would never allow access into each others systems, but I could be wrong.

<comment><USER23> It's less about budget and more about we're not the DoD and can do whatever we please, stay the hell off our lawn.

Even if it was a "hey, could you look at this and tell us what you think" with no obligation to address issues, it is undesirable to establish a precedence.

They do use standards and recommendations from NSA/OMB for enterprise systems. But even the US Courts went that route, just with a lot of renaming of things so it can't be seen as being subservient to the Executive branch. There are some good frameworks and standards that you shouldn't waste time re- implementing.

<comment> blaser-waffle Plus there is a reason you secure and compartmentalize information. The NSA may be comprised in some way, and giving them access means that deliberately or accidentally leak something vital.

Same idea in reverse with the CIA -- maybe someone in the CIA is a bad actor and now knows the secret 0-days the NSA is using -- because they're busy locking them down -- and those get leaked.

</comment></comment></comment></comment><comment><USER24> Guarding information and guarding physical assets have one thing in common. It is largely a passive exercise in waiting for something to happen. For this reason it is very boring and unreliable. The only way to improve the situation is to have active and random drills when someone attempts to steal the assets. This would make the work of the Blue team a lot more rewarding rather than just be relegated to mindless blocking access to anything and everything.

<comment><USER25> I mean you have more or less described a modern Cyber security Red Team.

</comment></comment><comment><USER26> >34 terabytes of information, or about 2.2 billion pages.

That's insane that they could leave so much data available to be stolen.

<comment><USER27> Most of it likely useless and junk, or thousands of pages of logs I'm guessing. No doubt there is some juicy stuff in there though.

</comment></comment><comment><USER28> Guess it's good to know that even big gov orgs are disfunctional

<comment> blaser-waffle all big orgs are dysfunctional. successful big orgs manage to work around it to a greater or lesser degree.

</comment></comment><comment><USER29> Unless you make engineers and entire companies focus on security through proper designs and standards, nothing will be secure. Most software is unsecure because geopolitically, the countries who make software are also the one who are able to penetrate those systems better than the rest of the world.

No government will push to improve door locks unless that government isn't the most capable of defeating those locks. It's a cost/benefit function.

Right now, improving software security is a net loss for the US. So it won't happen when the US is controlling the computer and software industry.

So I'm not surprised to see even the best experts being beaten so easily.

</comment><comment><USER30> A hacking unit is offensive. It's like saying, "america's elite nuclear force failed to stop an ICBM". Blowing up things (attack) is a different ballgame than defenfing things. Think of it this way if you are a hacker devoting 40hrs a week carefully studying and planning to infiltrate a network, you will succeed. APT actors have entire groups of teams dedicated to infiltrating one target at a time. Getting in is feasible, persisting,lateral movement and exfiltration without getting caught is very difficult but even commercial tools like cobaltstrike are built to allow different teams to focus on different stages of a hack.

<comment><USER31> It's more analogous to saying "the defense contractors for a new stealth plane failed to protect the designs and prototypes, so the enemy now has all of the detailed info they need to build countermeasures against this stealth technology". Securing the plans for stealth is a key requirement of the stealth continuing to work.

Also, I'm sure those members of "the hacking team" weren't allowed to discuss their work with their family/friends, so it's not terribly unrealistic to expect them to use even just basic security hygiene (eg. don't share admin passwords).

<comment><USER30> No, that's not what the analogy at hand. The designers of a stealth plane are just that. The right analogy would be if the navy seals designed a secret weapon, someone infiltrated their ranks and exfiltrated the weapons plans. Navy seals are not immune to moles. No org is.

Your implication that this was due to lack of proper security hygeine is unfounded. Security hygeine reduces risk it does not eliminate it. Risk is proportional to threat and attack surface, for an org like the CIA they have not-so-small attack surface and the whole world as their threat, so reduction in risk by means of common security controls and hygeine will not reduce risk from the most persistent and resourceful attackers.analogy to your reasoning would be "Google has an army of devs and security pros, so Chrome should never have a remote code execution vuln" ,no, as much as they may have money and talent, modern software is too complex for those resources to eliminate all bugs. Perspective is important.

<comment><USER31> I agree that your analogy works better.

> Your implication that this was due to lack of proper security hygeine is > unfounded. Security hygeine reduces risk it does not eliminate it.

Nope. No security professional will admit that anything ever _eliminates_ risk, so that's a strawman fallacy.

The point is that sharing admin passwords is a blatant violation of cybersecurity hygiene which every employee of the CIA is capable of understanding and avoiding. If the org can't enforce even just the basic stuff, there's not much hope of raising standards above that.

> from the most persistent and resourceful attackers.

Here's a secret that everyone already knows: the most persistent and resourceful attackers will always get in given enough time.

<comment><USER30> I agree on both of your last two points. Not sure where disagree then.</comment></comment></comment></comment></comment>