What If Students Could Fire Their Professors? - <AUTHOR> http://www.npr.org/blogs/ed/2015/04/26/401953167/what-if-students-could-fire-their-professors <comment><AUTHOR> Here's the take-away quotation for me:

        The better the professors were, as measured by their
        students' grades in later classes, the lower their
        ratings from students.

        "If you make your students do well in their academic
        career, you get worse evaluations from your students,"
        Pellizzari said.  Students, by and large, don't enjoy
        learning from a taskmaster, even if it does them some
        good.

<comment><USER2> I don't think that applies at the college/university level.

Evaluations are at the end of the course and you will know if you have learned a lot.

The problem is profs just reading the textbook or parts of the textbook in a powerpoint, without challenging students.

<comment><USER3> Even at the college/university level I have seen students complaining about professors that were fairly good, sometimes just because the grading was a bit tough.

<comment><USER4> Well those might be legitimate complaints. Professor is fine but his grading is too tough.

<comment><USER5> "Too tough" means "I didn't get the grade I wanted." Grade inflation is a real problem.

<comment><USER6> Agreed. When I was teaching before I started out as a developer, it was unheard of to fail anyone in an entry level Physics class (granted this was an Ivy League school); over many semesters I recall thinking that we had passed several students that had no business advancing "because medschool needs high GPAs" or because we didn't want to ruin some kid's future in engineering (when they may not have been successful anyways). But yeah many (most?) of the kids care about a high grade before learning anything, and expect nothing less than an A, even if they don't deserve it.

</comment></comment></comment></comment></comment></comment><comment><USER7> My undergraduate courses had professor evaluations. Using these evaluations unilaterally to fire professors is ridiculous, considering the varying incentives students have, the various reasons that professors end up teaching the courses they do, the various values that individual professors bring to university other than teaching, the various ways professors can improve given the right resources and support, etc.

But there are poor professors who are evaluated poorly by students yet teach year after year with no improvement. So the problem is that the evaluations are not being used properly -- by professors and administrators -- to make the necessary adjustments. Shouldn't we be firing the administrators?

</comment><comment><USER8> Students and professors are not peers.

A professor has to be able to force a student to do something they don't want to. "You don't understand this." "You're not doing this right." "You're not working hard enough to learn what you need to learn in the limited amount of time we have, here." Etc. A student might find this unpleasant, embarrassing, or whatever. But that doesn't mean the professor is wrong. Or bad at their job.

Student evaluations are valuable, of course, but the idea of using them alone to decide a professor's fate seems incredibly unfair.

<comment><USER9> Why 'unfair'? Because they're being rated by a person that knows them from only a few hours exposure a week, in a stilted environment and based on a narrow context of arcane skills?

Sounds like a student's life. Cry me a river, professor.

<comment><USER8> Students and professors are not peers.

<comment><USER10> The professors should be servants, in the same light a server is to a meal. I pay for it, I get it the way I want.

<comment><USER11> That's not a very realistic view of things. First of all, a professor's job consists of many things, of which teaching is just one. Depending on the institution, your tuition may be a very miniscule portion of the professor's paycheck. Finally, even if they're solely a lecturer and payed entirely from tuition, what you want isn't necessarily what other students want, so unless you've hired the prof as a private tutor...

<comment><USER6> You strike on a significant point that most HN types have no idea about: the majority of most big schools that do any research (state schools, big private schools like Ivies) get the majority of their budget from taking a cut of research grants, and secondarily from state funding and tuitions. At the various schools I have been involved in different forms with, tuition covers on;y like 20-40% of operating costs; the people who were really keeping the university afloat were researchers _not instructors_. It is partially because of these huge monetary incentives that STEM professors are usually expected to be researchers (and administrators of grad students) first, and teachers second: they have to pay the bills.

<comment><USER9> Iowa gets 5% of its funding from the state, reduced in budget cuts every year for decades. I honestly don't know why they don't cut their ties - 5% isn't worth all the Board of Regents interference.

<comment><USER10> Precisely. Ever since Reagan, Public schools are dwindling to Private with a token appreciation and control from the state.

My parents also told me of a time when one could work a summer job and pay for the rest of school year. Long are those times gone.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> How will we know that student ire will be directed at the right individuals? What _are_ the right individuals anyhow? At my department in my beloved state school there are three full professors, each with no grants, paid USD 120000 for doing no research and giving one bad lecture per semester. Then there are several lecturers who are paid USD 40000, doing a better job at lecturing, and more lecturing altogether. We also have half a dozen assistant professors, who are struggling to bring in grant money and altogether doing an admirable job.

The great majority of the students doesn't know how the sausage is made and should well keep out of personnel decisions. They don't even know what the sausage is!

</comment><comment><USER13> This would not work, often students perceive strict professors has being bad because they give too much work load or are too strict. It also goes against excellent researchers who are contributing a lot to science but are not great teachers. Often these are "forced" to teach by their university because otherwise they don't get grants.

I am not in academia, but in retrospective some of my greatest professors where very hard to deal teachers with huge fail rates. Most students hated them.

<comment><USER14> I've never had a bad STEM professor who was proficient in English. I don't know if I've just been lucky or if this is a common misconception about the role of a teacher versus a professor.

<comment><USER15> I think you were lucky. I definitely had some miserable professors and TAs who were native English speakers. And some professors and TAs with comically bad English but who were good at what they did anyway.

<comment><USER14> Yeah I had plenty of good ESL professors but I also had a few that, try as I might, I could not learn from.

</comment></comment></comment></comment><comment><USER16> I would like more accountability from professors somehow. Maybe not from student reviews, but at least someone unknown to the professor randomly attend a few classes to check the quality of them. Right now I have a professor that says things during class that are obviously incorrect, and can be verified as incorrect. Her attitude towards students is also disrespectful. But there is nothing we can do about it, no way to communicate to the university that they should be embarrassed and ashamed to have such a professor.

<comment><USER17> Have you tried to do so? I've seen coherent, well-written letters from a large number of students influence the direction a course took (it was redesigned from the ground up for the next year), and both student and peer evaluations of teaching are definitely a factor in tenure decisions - and depending on the position, may be a major factor.

But I'd start with laying out concrete things, rather than "embarrassed and ashamed".

</comment></comment><comment><USER18> What if students could fire the ADMINISTRATORS?

What if students could run the university?

<comment><USER19> Honestly, at the school I went to, I would've preferred to have the power to fire the administration versus the faculty. Most of the faculty are just fine. Some were great, most had their little quirks and a couple really sucked at their jobs, but that's true in most fields. The administration seemed to spend most of their time giving themselves raises and flushing money down toilets.

</comment></comment><comment><USER20> Degrees granted from any university that regards students as customers are automatically worthless junk, because they are essentially purchased goods.

When a professor is rated low, at least some of that rating has to do with the professor having a high standard in the awarding of grades and passing of students.

If students get good grades then no matter how much the lectures suck, or how unavailable that professor is for help and so on, large numbers of those students will not rate that professor low. Poor grades are the exacerbating factor in a revolt against a professor.

If you're a C student, the moment you see a B+ next to your student ID on the course results table, all memories of the prof either vaporize or become rose- colored.

<comment><USER21> Degrees and grades are a big part of the problem because they are treated as currency to get a job. Degrees are like the Microsoft points system. I want a job in field XYZ. Well to get that you have to buy 256 credits. But, but, it looks like the job really only requires 120 credits. Too bad you have to buy 256. Ok, fine... WTF, part of the 120 credits have absolutely no relevance to the thing I want to do. Yeah, well you still need to take them.

<comment><USER20> All university credits are relevant to that job, even those humanities courses and whatever. Credits directly relevant to the job skills are more like vocational training; whereas university is supposed to be about education.

Also, one reason some jobs prefer applicants with degrees is because university completion shows that you have some ambition and willingness to work hard toward a goal that is several years away, in the face of deadlines and stress, and possibly financial risk also. They know you've pulled a few all-nighters to get through.

In other words, you're gone through a pretty tough four year (or more) project: to produce a degreed version of yourself.

That degree shows that you can _work_ , even if you don't have employment experience.

<comment><USER21> One can say that all university credits are relevant to any job but only in the most general sense. Certainly you wouldn't advocate 8 years of general education before getting into degree specific education so the amount is at the very least arbitrary.

Yeah you are probably right about ambition as a general filter too. But the point remains that universities take advantage of this. They know full-well that plenty of students are there to get a job and they can and do milk this.

Issuing degrees is not part of Universities being "about education". Degrees are an arbitrary milestone, that can be received after completing a nearly arbitrary set of classes, that in-turn have taught an arbitrary set of lessons. The fact that Universities have coalesced around issuing degrees of the same type without ensuring their curriculums match further makes the degrees aribitrary.

</comment></comment></comment></comment><comment><USER22> I have had a chance to look at course evaluation data over time and the scary thing about it is how quickly ratings can change from year to year. One year a professor might be considered an absolute rock star with students raving about the course, but a problematic upgrade to a piece of software used in the course can drive students absolutely mad the next year. I'm convinced that there is a group think that occurs very quickly in the term and profs are immediately labeled as either stars or bozos, and it is hard to change that perception once it has formed.

Another huge factor in course evaluations is the economic environment and prospects for upcoming graduates. Tight labor markets seem to correlate with higher course evaluations as students value subjects that will hopefully make them more marketable. Conversely, a lot of courses get hammered when the job market is good because students start getting a "just give me the piece of paper so I can get out there" feeling.

<comment><USER17> The thing that strikes me is how small the sample sizes are - most students really can't be bothered to fill out evaluations, and those who do are probably not an unbiased sample. There's often maybe a handful of evaluations per year for anything but massive lecture classes. It's hard to even _make_ meaningful or realistic estimates of the quality of a teacher from that data.

<comment><USER22> Very true, but there are certainly ways that schools can up the response rates if they are interested. Some schools authentication systems that store a student's ID on one system when they complete the evaluation and the actual response anonymously on another system. You can then set policy to say, "Your final grades will not be released until you complete the course evaluation." I have also noticed that giving students 10 minutes at the beginning of the last class, with the professor leaving the room, helps the rate.

</comment></comment></comment><comment><USER23> I have finite attention. Attention (time and effort) is probably more important to my learning than the quality of my teacher. Without attention you fail. With infinite attention you get a perfect grade.

When you take a hard course it consumes a disproportionate amount of attention. Even if the teacher is bad at his/her job a harsh grading scheme will drive you to spend hours in the library. You will learn a lot because you are burning valuable attention; attention other classes can not have. So such a class necessarily good? Of course not. Not if the learning benefit is outweighed by learning opportunity cost.

So regarding the finding of the study

        The better the professors were, as measured by their
        students' grades in later classes, the lower their
        ratings from students.

I'm not confident that performance in later classes of the same sequence is a fair measure of learning; what matters to me is performance in ALL later classes. How do evaluations correlate then?

</comment><comment><USER24> One vote for the point of view that says I don't really much care how well- rated as teachers research professors are.

My tax dollars should be mostly _supporting their research._ Teaching should be a _collateral duty_. It is _not a valuable use of time_ for good researchers. If we need superb instructors to teach basic material to undergrads, let them be called something else.

Is there really a single person on this forum who didn't do the bulk of their real learning outside the classroom, anyway?

<comment><USER25> It's not as prestigious, but a college without a graduate program will have teachers that are there just to teach. You get taught by professors not not teaching assistants.

<comment><USER24> That's fine and even important, but there are huge swathes of the American population that don't understand the distinction between research professors and folks like teachers, instructors, and lecturers. They get painted with one brush and, in this instance, are used to score political points with grossly ill-informed voters who have somehow decided that they don't like universities.

</comment></comment></comment><comment><USER26> As a student myself, in my final year of University and I do feel that there definitely needs to be more control/transparency where the tuition fees go.

The faculty that I am on is one of the lowest scoring areas of the university according to the National Student Survey. I assume this is due to the lecturers not having the knowledge or experience when compared to the students who are passionate about their field which they are currently studying for a degree in. Most have managed to get the job with little industry experience to share with students and don't have experience with a modern workflow such as using Linux, git, etc.

Personally, I would be much more happier if the lecturers have a basic salary but then allow students to give more of a percentage of their tuition fees to the departments that keep up to date with their field.

</comment><comment><USER27> I'm an abrasive type teacher who gets polarized response distributions. Once when I substituted for the most highly rated professor at a local cc in my subject, I received a most memorable compliment: 'Finally, a real teacher.' ... I quit teaching after one too many interventions from administration and parents about crying kids who could not possibly make less than an A.

</comment><comment><USER28> I've heard about (but not yet read) studies indicating a similar relationship between patient satisfaction and outcome for medical professionals to the one between student satisfaction and outcome. There's a pretty strong negative correlation between the two.

Frankly, I'm not surprised. Back when I was TAing and tutoring, it was pretty clear to me that a great many students just wanted the high mark, and were much less concerned with how they got it. And I've had _way_ too many conversations with people complaining about a doctor refusing to prescribe antibiotics for a viral infection.

</comment><comment><USER29> 'Ted Hilles, the chairman, was a remarkably kind man who was embarrassed by having to do so, but he read the student comments aloud to each of us. "This is the kind of teacher that I came to Yale to study with,", the student you had given a B+ or an A would say. Then there would follow the report of students like Smithers, to whom you cad given a C or a D: "This man is the worst teacher I have ever studied with, he is a disgrace to the Yale faculty and far infirior [sic] to my masters at Andover. A profound cynicism about student comments was born from the experience of hearing these absolutely opposite evaluations one after another and knowing how closely they correlated with the grades you had given."

\--Alvin Kernan, _In Plato 's Cave_

I don't recall there being student evaluations of teachers in my undergraduate days (which were _not_ spent at Yale or anything like it). When I went back to school part time in my 30s, I wrote bad things about only a couple of instructors, both for showing up unprepared (and occasionally not showing up at all).

<comment><USER30> The problem with this approach is that it's hard to evaluate the performance of your teacher until many years later, at a time when you only just came to realize that not only had you learned a lesson, but also the magnitude and how profound that lesson was. I didn't come to appreciate everything my grade school teachers instilled in me until many years into my professional career. If you'd asked me as I was getting ready for my exams how I'd rated them as teachers, those I liked the most would have gotten the highest grades regardless of how much I'd really learned from them. Those I liked the least would have gotten the lowest grades. It wasn't until many years later that those I liked the least during my academic career (if you can call it that) were the ones who actually taught me the most. It would have been a shame for them to be fired on something so subjective as how much I liked them or how dissatisfied I was that they'd just issued me the 4th 'D' grade in a row.

It's only now that I genuinely appreciate everything they taught me that I feel honestly worthy of sitting in their classroom again to learn what is they're willing to impart.

So I say thanks to those teachers that pushed me, those that held me accountable, those that I disliked during school. It was you that would likely have been fired by these performance evaluations that gave me the most. I just never would have had the foresight to give you the grade you deserved.

</comment></comment><comment><USER31> As someone who had a few professors/teachers who I hated while in their class, and now really appreciate looking back : Never trust a student opinion on a professor.

</comment><comment><USER32> Determining professor tenure via student rating is obviously an extreme idea and likely to fail as outlined by many of the other comments in this thread. But, framing students as customers, is a worthwhile debate to have in the US given the high cost of tuition. Considering the crushing debt student loans can create, students should think of going to college as an investment with risk and return. I wish it were not this way. Let's not pretend that most US universities aren't operating like sophisticated businesses concerned with marketing, generating revenue, and besting competitors. That makes students (along with some other groups) customers. And perhaps if these customers are unhappy, maybe we should blame management (administrators) instead of professors.

</comment><comment><USER33> When I was studying CS in undergrad I took an upper level CS course that was suppose to end with learning assembly and building something with it. The class for whatever reason moved excruciatingly slow and we never got past the second or third project. The following semester my advisor who was also a cs professor pulled me aside and asked me, "what the heck happened in that class?" And after my answer he said he would take care of it.

For whatever its worth the professor that was teaching the class was and still is the head of the department. And the other professor I confided in retired the following year and moved to Florida. Probably unrelated, but I can see department politics fixing the issue of poorly taught classes.

</comment><comment><USER34> I just wanted to say few things about my experiences on reading students' ratings on ratemyprofressor.com.

First, professors who consistently get good ratings are usually very good lecturers. They are not necessarily easy profs. But they do give great lectures and explain things more thoroughly. On the other hand, professors who get consistently low ratings are usually not good. For example, last term, I took a course with a prof who got 2/5 on ratemyprofessor and her lectures indeed suck although she is a kind person. She doesn't explain the math materials she is teaching; just barely writes down notes on the board. And all the students I have talked to also think she is not a good teacher. The term before I took a course a prof who got 4/5 on ratemyprofessor. She is indeed a great prof and explained everything so clearly. Our class wrote the same exams as the sections but our average was 7 percentage higher overall.

Of course, the ratings from that website may not be equivalent to the ratings profs get from their actual teaching evaluation. But from my experience, I think the students do have the ability to distinguish between good profs and bad profs. And students' ratings are not only based on how easy the course is but also based on how interesting the lectures are and how approachable the prof is.

Does anyone who has an opposite experience from what I have experienced? That is taking a course who a prof who got high ratings on ratemyprofs but felt the prof was bad.

<comment><AUTHOR> But everything you say is what everyone believes is "common sense." If all you want are clear lectures well delivered, great, follow the advice on some random rating website.

The research, however, says that the student evaluations are negatively correlated with subsequent ability in the subject. In other words, you are repeating the common sense view that is flatly contradicted by careful research.

What should I trust: your anecdata, or published research?

</comment></comment><comment><USER5> Idiotic and the adoption of it would destroy public universities, but I suspect that's actually the intent (just like the NC stuff about how professors must teach 4 classes a year).

</comment><comment><USER35> I see an article and HN post full of obsolete old people thinking. You can't outsource responsibility for your life to someone else and then complain about it. The prof is not responsible for what a student learns or enjoys any more than the prof is responsible for the students sex life or religious belief. The student is responsible for learning the material. If the prof refuses to answer questions or refuses to eval the students the prof is guilty. If the students are lazy thats too bad for the student, sucks to be them. If the students don't like their prof, who cares, they're just ignorant kids till they learn something useful...

Old people thinking is you learn for 4 years then work at the same company doing the same thing for 43 years and retire with the corporate gold watch. Young people thinking is you learn full time for 4 years and then work while learning part time for 45+ years. For 4 years you have profs who you think you can outsource your responsibility for learning to... and your plan for the following 45+ professor-less years, still have to learn with no one to outsource your responsibility for learning to? Good luck with that.

There is also the missed effect of warped samples because the population is not constant over time. Lazy students either sink or swim and possibly learn to avoid hard profs in the future. Given that selection pressure its hard to imagine hard profs not resulting in better grades later because the sample is self selecting itself away from hard profs or dropping out. Even if there is no difference in educational attainment between hard and soft profs.

</comment><comment><USER36> "And therein lies the paradox. Yes, students are paying, often handsomely, for their degree. But they're not exactly customers, either. They're participants in an experience — one that is meant to be challenging, even grueling."

If that's "not exactly" the definition of a customer, I'm not sure what is. The students are customers. The real paradox is if they vote for easier teachers, the product they are buying loses its value.

<comment><AUTHOR> Perhaps the problem is that the customer thinks they're buying one thing, the professors think they're selling something different. There's no clear statement as to what the product actually is.

Is the product an education, or a degree?

</comment></comment><comment><USER37> Terrible idea. I went to a school where students had no problems calling mommy and daddy and the parents had quite the culture of bringing lawyers against the university.

The university had a rule of never taking these things to court, so they would always settle. Even when it was stupid things like students violating an attendance policy, failing their class because of it, and then getting off scott free beacuse their parents called a lawyer.

Disgusting practice.

</comment><comment><USER38> Yeah, this is certainly ridiculous. Student ratings often correlate more with grades than they do actual effectiveness of professors.

The professors who inflate grades (and thus are really the ones that are diminishing educational value) are the ones who would keep their jobs.

I like the place this is coming from (there's zero accountability from students to professors). But such an extreme measure is something I feel would work against the end goal.

</comment><comment><USER39> The last thing we want is a coalition of creationist students getting their biology professor fired because he dared to teach them about evolution.

</comment><comment><USER40> I hate history. HATE HISTORY.

In Uni I had to take my final history course and only 1 professor was available. Little did I know at the time...

The man was a hardass. a quiz every single class over the previous classes lecture, you can only make up 3 quizzes, after that it's too bad so sad.

And yet I LOVED the course. People talk about good orators and I had never known one until I met this guy. I was absolutely enthralled every lecture. He was just amazing to listen to, somehow he made what he was talking about seem exciting, it was crazy.

I passed the class with an A and I've never regretted taking that class. I remember it fondly. And I'm the guy that would completely stop going to classes, showing up only for the tests, so that's saying something.

I think it's a terrible idea to start grading professors on by their students evaluation. I think student evaluations are good, but personally I think too many professors already cater to their students, the problem would only get worse. And the ones who are there to learn will get left behind.

</comment><comment><USER41> > "Professors need to understand that their customers are those students,"

Perhaps professors should work for tips too /s

</comment><comment><USER42> Let me give you the other perspective, the one where we ask if the professor is payed by the University to teach. From my understanding they are chosen for their research, their interest lies in research and so the incentives are aligned towards that.

That way teaching for a large amount of academic professors is just a side- job, and comes secondary in the pecking order to researching itself. I'm specifically targeting Management/Business courses in the UK.

Now you see why student evaluations are used. We can suffer the consequences of this disconnect between incentives and foci of an academic, and that becomes problematic.

Most academics need to be kept in check, and connected to the realities of how the students experience their course, in terms of "support available"; "clarity" etc.

</comment><comment><USER43> What if a small, semi-random sample of voters could fire an elected official for any piece of legislation they attach their name to?

I see the grades in Iowa elevating and the market-value of a degree from Iowa discounting. You get an A! You get an A! You get an A! You ALL GET AN "A"!!!!

</comment><comment><USER44> It's really frustrating when I paid $50k/yr at a top 5 univ for CS deg, and some of the CS courses (including a junior year core) were taught by PhD students with incomprehensible English accents. I have no issue with non- english speakers getting their PhDs...they're obviously very intelligent and I respect them greatly...however, they are not suited at all for instruction by lecture... in those courses i learned nothing during class, and learned everything myself later on.

i once had a PhD student as lecturer in an advanced track course -- we bumped into him at a bar one saturday...this guy was jumping all over the tables, drunk and wasted out of his damn mind...

now i did have some amazing profs but those were all tenured.

</comment><comment><USER45> In my experience, the teachers I learned the most from were also the best teachers, i.e. the most engaging. Difficulty was really a separate concern, in a lot of ways. There were very easy courses that I learned a huge amount from, and difficult courses that weren't worth the time I spent on them.

To be honest, I only bothered to rate professors because I couldn't see my final grades until I did so. Consequently, only the very excellent and the very terrible really got any kind of response.

</comment><comment><USER46> I am _SO_ fucking glad that I'm not in academia anymore.

</comment><comment><USER47> Sorry. Outside of community colleges, professors are researchers first and teachers second.

Let the students fire the TAs. Not like they get paid anyway.

</comment><comment><USER48> Students rating professors is bad because

1\. Professors raise bar sometimes which students find difficult to cope with and result in low feedback

2\. Some students try to "hit" professors with low grades since they are not interested in them

3\. More work by professors means low grades from students

This is what usually happens in India and I am a professor

<comment><USER21> I disagree completely. You are confusing students rating professors with the how good the survey is and how the university may or may not react to the results. In an of itself rating professors is not good or bad.

1\. Part of raising the bar should be making sure students understand that you are doing it and are into it. Also by saying "raising the bar" you are implying that they are going above what the rest of the university is doing. Which is an indictment of the university not of the students. 2\. Why aren't they interested in them? Could it be because they are not good? 3\. So professors should be able to assign any amount of work that they deem fit? If its a 2-credit course with the workload of a 4-credit course then the professor is bad. If its a 4-credit class and other 4-credit classes have significantly less work, then the university is screwing up. If the its a 4-credit course with a lot more work than other 4-credit courses then that should probably be clearly conveyed up front or have some mechanism for conveying that.

</comment></comment><comment><USER49> I am studying media art at the University for Arts and Design Karlsruhe, Germany [1]. It was founded in the nineties, alongside ZKM, the Museum for new media [2]. One of the founding principles of the school was to limit professor tenure to three years, regardless of the performance. The idea behind it was to prevent the school to become a morass of old ideas and stay competitive in a new field.

It succeeded to a degree, especially with regard to the sheer number of different artistic positions that get to be represented at a small university. It is not without fault however - the quality of teaching is not constant; after a professor leaves there is oftentimes a semester of emptiness until a new one arrives.

And while the students can not fire a professor, they have a vote in the committee that decides which person to hire as the next professor.

[1] [http://www.hfg-karlsruhe.de/](http://www.hfg-karlsruhe.de/) [2] [http://zkm.de/](http://zkm.de/)

</comment><comment><USER50> What if kids could fire their parents?

</comment><comment><USER51> Everyone would get an "A"?

<comment><USER2> You can still not learn very much and still get a good grade.

Students are attending to learn and will give negative reviews when they are not learning as much as they expected they would learn.

<comment><USER52> _Students are attending to learn_

Depends very much on the course. A lot courses are attended by a lot of students who just need the course to fulfill some requirement and want nothing more than to get a pass with as little work as possible.

<comment><USER5> It's hardly the case that the same thing doesn't apply to students majoring in the subject.

</comment></comment></comment></comment><comment><USER53> Having been through three colleges, the professors that seemed to be disliked were not the ones that were the most difficult, but the ones that were terrible at explaining the material to the students.

For some classes, students stopped going to class and studied on their own.

</comment><comment><USER54> I attended Deep Springs College, where students literally hire and fire the faculty. It works all right on a very small scale, when the students are committed to learning. Not so well when the students don't like the work that learning requires.

</comment><comment><USER55> A universitys main focus should be on research, education is second. Let the colleges educate the masses. Therefore students shouldn't have a say in if a professor should be on the faculty or not, as long as he is churning out good papers.

</comment><comment><USER56> Let me rephrase it a little bit .. What if in Kung-Fu Panda , the panda could fire his master . FIRE is very strong word , it talks about power over another , teaching is more of trusting some one and accepting someone higher .

</comment><comment><USER57> comments on student evals can be crazy. I once had a student write "Stop dressing like a hobo."

Who even uses the word "hobo?"

To be fair I was going through a faze where I was carrying my things around in a bandana tied on a stick... ;-)

</comment><comment><USER58> The market would fix this should the bill become a law. All professors and applicants who care about their jobs will just leave Iowa or never go there in the first place. I wonder who will suffer then?

<comment><USER59> Wages will increase and the highest quality professors will flock to Iowa to become millionaires. Kinda like how it is in Korea.

<comment><USER58> Have you seen professor wages recently? It would be much cheaper to lobby to counter the law than it would be to give wages that would draw professors to a shitty job. If they wanted wages, they'd leave academia anyway.

</comment></comment></comment><comment><USER60> After I'm finished firing my professors, do I still get my degree?

<comment><USER35> The purpose of higher ed is to outsource the selective pressure from corporate HR depts to university admissions depts. So the corporation can hire the "right people from the right social groups" by using the degree as proxy.

Seeing as the admissions dept has already done all the work of filtering applicants to select the right ones, sure, why not.

May as well issue the degree at admission time, skip the dog and pony show of 4 years of attendance. It'll have little to no effect on outcomes in non- vocational fields.

The vocational fields don't belong at uni/college anyway, they belong at vo- tech schools just like welding or diesel repair.

</comment></comment><comment><USER61> How does this not violate the Eighth Amendment: _Excessive bail shall not be required, nor excessive fines imposed, nor cruel and unusual punishments inflicted_. Automatic loss of job with no recourse can be seen as both an excessive fine and a cruel punishment.

In other news, a friend's wife here in Australia was an XO at a Navy training base. He told me that the base brought in a 'soccer card' system where the recruits could card the drill sergeants and make them face disciplinary action. This didn't take long to completely undermine the ability to make the recruits learn anything and waste the CO's time with meaningless disciplinary hearings, and was turfed out in short order.

</comment><comment><USER62> What about giving feedback after graduation?

</comment><comment><USER63> I can see it now, it will be like Lord of the Flies... Or perhaps profs will feel obliged to give out A's to keep their jobs.</comment>


Cash for Caulkers: Home Weatherization as Economic Stimulus - <AUTHOR> http://www.nytimes.com/2009/11/18/business/economy/18leonhardt.html

<comment><AUTHOR> The potential results are almost unbelievable:

"The bottom line is that cash for caulkers would be trickier than cash for clunkers — yet would have the potential to do far more good. McKinsey, the consulting firm, estimates that households could reduce their energy use by 28 percent over the next decade. In terms of greenhouse gases, that would be the equivalent of taking half of all vehicles in this country off the road."

</comment><comment><USER2> Clever title.</comment>


The Most Important Factor Of Startup Success - <AUTHOR> http://techcrunch.com/2014/07/28/the-most-important-factor-of-startup-success/?ncid=rss

<comment><USER2> Here's an introduction to OKR's we recently did in addition to the resource link in the article: [https://blog.weekdone.com/introduction-okr-objectives- key-re...](https://blog.weekdone.com/introduction-okr-objectives-key-results/)</comment>


Goethe's Aphorisms - <AUTHOR> https://fs.blog/2019/10/the-best-of-goethes-aphorisms/ <comment><USER2> I'd like to add a short and serene poem which Goethe "probably wrote [...] onto the wall of a wooden gamekeeper lodge on top of the Kickelhahn mountain where he [...] spent the night." [1]

 _Wandrers Nachtlied_ ("Wanderer's Nightsong")

        Über allen Gipfeln
        Ist Ruh,
        In allen Wipfeln
        Spürest du
        Kaum einen Hauch;
        Die Vögelein schweigen im Walde.
        Warte nur, balde
        Ruhest du auch.

        O'er all the hilltops
        Is quiet now,
        In all the treetops
        Hearest thou
        Hardly a breath;
        The birds are asleep in the trees:
        Wait, soon like these
        Thou too shalt rest. (Henry Wadsworth Longfellow)

[1] [https://en.wikipedia.org/wiki/Wanderer%27s_Nightsong](https://en.wikipedia.org/wiki/Wanderer%27s_Nightsong)

<comment><USER3> nuts

</comment></comment><comment><USER4> It's hard to overstate the importance of Goethe to German culture and literature. He was a brilliant man with a lively mind. One nonfiction work of his I quite enjoyed is his Theory of Colours[1]. While many dismiss it as "wrong" because it isn't a correct physical theory of wavelengths and spectrum, that's not the point. It's really about the perception of color, which is psychology and not physics.

On a similar note, Elective Affinities[2] is a novel about human relationships that is inspired by chemistry. To this day even in English we refer to two persons as having "chemistry" together.

[1] [https://en.wikipedia.org/wiki/Theory_of_Colours](https://en.wikipedia.org/wiki/Theory_of_Colours)

[2] [https://en.wikipedia.org/wiki/Elective_Affinities](https://en.wikipedia.org/wiki/Elective_Affinities)

</comment><comment><USER5> If you enjoy Goethe, have a read of La Rochefoucauld's maxims which preceded Goethe by a century.

"Most of our faults are more pardonable than the means we use to conceal them."

</comment><comment><USER6> One need only grow old to become gentler in one's judgments. I see no fault committed which I could not have committed myself.

:-)

<comment><USER7> Have to say this one got me thinking somewhat. Nowadays we would call these observations 'tweets' of course.

<comment><USER8> Only if we get sucked into the LocNar's twitter ...

</comment></comment></comment><comment><USER9> > #33. Everything that frees our spirit without giving us control of ourselves > is ruinous.

E.g., smartphones

</comment><comment><USER10> > Difficulties increase the nearer we come to our aim.

 _The first 90% of the code accounts for the first 90% of the development time. The remaining 10% of the code accounts for the other 90% of the development time._

</comment><comment><USER11> a great philosopher and poet he may have been, but it is hard to overstate his negative impact on colour theory. His magnum opus, Colour Theory, was an emotional rambling mess that took colour thinking away from Newton's empiricism. The first half of this book is never translated as it effectively constitutes a hate letter to Newton. the further tragedy is that it is clear that Goethe had a mostly mistaken understanding of what Newton was stating.

<comment><USER12> Hegel attacked Leibniz and calculus. Philosophers can be weird.</comment></comment>


Anonymous FasTrak account - <AUTHOR> http://goldengate.org/tolls/iwanttoremainanonymous.php <comment> ryan-c It seems like this is only anonymous as far as you trust FasTrak not to keep records. Your transponder will eventually fail to read going through a toll plaza. Then what? I see a couple options:

* Resolve the toll evasion by associating your plate with your account, then removing it again (surely they keep records of this...)

* Pay the toll evasion fine ($25, apparently this does not increase for repeat offenders). Since the golden gate bridge doesn't have cash toll collectors, I think the no-FasTrak is only an extra dollar.

* Get a second, non-anonymous account associated with your plate and leave the transponder at home. I think you can get in trouble if your transponder repeatedly fails to register, though.

</comment><comment><AUTHOR> I was looking around and trying open a FasTrak account online and noticed the option to open it anonymously. Does anyone have experience with this option? Is it more hassle compare to regular account? For me mailing a money order monthly to replenish balance is acceptable but is there any other catch?</comment>


The Difficulty of Private Contact Discovery - <AUTHOR> https://whispersystems.org/blog/contact-discovery/ <comment><USER3> The problem isn't that social networks can't implement this, it is that they don't want to.

Facebook and LinkedIn, for example, want to know who all our contacts are, because that data is so valuable to them.

This needs to be built into the mobile OS. The OS should only be allow third parties to access some kind of protected contacts, nothing more.

Furthermore, we need fine-grained control in the mobile OS, to optionally block apps from accessing private information.

Apps should still work if certain privacy features are enabled by choice, rather than the default today, which appears to be "install our app and accept our defaults for 'all the things' or don't use our app".

Bravo to Whisper Systems calling this out, and trying to work towards a technical solution.

<comment><USER4> You might want to reread the post: "As far as we can determine, practical privacy preserving contact discovery remains an unsolved problem."

<comment><USER3> But there is some degree of success mentioned in the article, even if it doesn't work for huge networks.

That being said, some degree of privacy is better than none at all. Currently Facebook et al upload every single piece of contact information we have on our devices. That's insane from a privacy perspective.

</comment></comment></comment><comment><USER5> Where the article enumerates the reasons one might not want to share one's entire address book, it leaves out the one most important to me. If I allow an app access to my entire address book, it can see atrributes on an entry that I feel I should not leak such as birthdate and home physical address. Address books need a finer grained way to express such access control. Even when sharing a contact with a third person and not a service, I might not want to share the entire address book entry for a person.

<comment><USER6> In iOS, you can present a contact picker and the app will only get access to the user final selection (a contact or a contact property).

[https://developer.apple.com/library/prerelease/ios/documenta...](https://developer.apple.com/library/prerelease/ios/documentation/ContactsUI/Reference/CNContactPickerViewController_Class/index.html#//apple_ref/occ/cl/CNContactPickerViewController)

<comment><USER5> Interesting. I was aware that this new API exists. I've not seen an app use it yet. I was not aware it could narrow the selection down to just a single contact property. The documentation does not make that clear.

Nevertheless, apps like Facebook aren't going to use this as they want the whole address book and not a single person.

</comment></comment></comment><comment><USER7> The use cases are interesting to me. I once crossed a border where my phone was taken from me, into another room. It doesn't take a rocket scientist to work out that an image was lifted from it before it was returned to me. Sending text messages from that same country had a typical latency of between one and four hours before arriving back home. There are not many people I want to communicate with privately, so I wrote my own secure app to send encrypted text to a web site located in a country I trust, from where it's forwarded as required. I know my contacts, and don't want those contacts known to others. There aren't many I feel the need to exchange messages with securely, and therefore don't want my contacts "discovered".

So it would be nice to find something some day that lets me confidently opt out of ANY kind of contact discovery. As it is I don't install any apps on my phone that require permission to access my address book. I realize that this probably puts me into a tiny subset of user profiles, so not holding my breath. My own solution is clunky, but it appears to remain my best option for the foreseeable future.

<comment><USER8> What do you think of Wire.com? Doesn't need access to address book (like WhatsApp didn't until a few years ago). See discussion elsewhere on this page for a few links.

</comment></comment><comment><USER9> Phil Zimmermann did come up with a protocol that avoids sending everything, which I implemented here:

[https://github.com/SilentCircle/contact- discovery](https://github.com/SilentCircle/contact-discovery)

Moxie said it wasn't "meaningfully private", if I recall correctly, without elaborating further.

<comment><USER10> As far as I can see this is quite similar to the 'sharded bloom filter' discussed in the submitted link.

This approach is dismissed in the document as

> In the end, this strategy seems to provide very little at the cost of fairly > substantial complexity.

Since it seems you use it for silent circle, how does it work there? How many 'longer hashes' do clients get on average per submitted 'short hash'? How large is the 'false positive' rate you get from the long hashes? Since the argument against the 'sharded bloom filter' in the submitted link boils down to 'the tradeoffs don't work', I would be very interested to know how these tradeoffs work out for silent circle.

As far as I understand, you would still need to have some rate limiting in order to stop someone to collect all registered phone numbers though, wouldn't you?

<comment><USER9> > As far as I can see this is quite similar to the 'sharded bloom filter' > discussed in the submitted link.

It's pretty similar, but not exactly like that. The main difference is that the server doesn't need to transmit a bloom filter, it transmits partial hashes, but yes, there's a tradeoff.

> How many 'longer hashes' do clients get on average per submitted 'short > hash'? How large is the 'false positive' rate you get from the long hashes?

I'm afraid I don't know the answer to these questions, as we don't keep logs... The false positive rate of the long hashes should be astronomically low (since they are full 256-bit hashes), but it doesn't much matter because the client only needs to be reasonably sure that the user exists so it can perform an actual query with the plaintext identifier.

The problem isn't really "we shouldn't know any of your contacts", it's "we shouldn't know any of your contacts that aren't using our service", since clients have to divulge _some_ of their contacts in order to set up calls with them or send them messages. That means the client only has to know which of their contacts are probably on the server so they can request more information, which will, at that point, tell them with certainty whether a contact is using the service.

P.S. My opinions are my own, I'm not speaking for SC, etc.

<comment><USER10> I have to say that this sounds very reasonable (and certainly a lot better than sending your plain text contacts).

Does anyone know what kind of solution Signal is using nowadays? The linked article is not very recent and they might have changed their method in the meantime. I had a quick look at their source but was not successful in finding the relevant part for uploading the contacts.

</comment></comment></comment></comment><comment><USER11> From 2014. Previous discussion: [https://news.ycombinator.com/item?id=7007554](https://news.ycombinator.com/item?id=7007554)

</comment><comment><USER12> I was recently reading about some of the interesting work with invertible bloom filters/invertible bloom lookup tables, eg [0] [1].

There might be either a clever way to exploit IBLTs to to make a low- information query of the data (like "Oblivious Selection from a Table" in [1]), or otherwise there may be a way to use them to more efficiently implement the bloom filter/sharded bloom filter options.

My information theory/coding theory is not strong enough to really know, but it might be worth looking into!

[0] [https://www.ics.uci.edu/~eppstein/pubs/EppGooUye- SIGCOMM-11....](https://www.ics.uci.edu/~eppstein/pubs/EppGooUye- SIGCOMM-11.pdf) [1] [http://arxiv.org/pdf/1101.2245.pdf](http://arxiv.org/pdf/1101.2245.pdf)

</comment><comment><USER13> _The average Android user has approximately 5000 contacts synced to their device._

This seems staggeringly large.

<comment><USER14> Yes, that number startled me as well - it is so far beyond Dunbar's number that it must represent the result of some automatic collection process. Perhaps Gmail harvests all the email addresses passing through your inbox and stuffs them into the contact list? I imagine that most people using Android phones are less persnickety than I am about allowing Google to manage their lives, so I can imagine that Google might be routinely shuffling large numbers of "contacts" around, which the user of the device neither knows or cares about.

<comment><USER15> I think it's the gmail "you've emailed them so now they are a contact" and other social services syncing their address books into your address book.

</comment></comment></comment><comment><USER16> Well, here's another UX nit to pick with Signal. On Signal, I have multiple contacts that have been uploaded/updated somehow. They are grayed out in the address book so I'm kinda sure they are not on Signal just someone else that knows them.

What's not clear to me is why/how this is being determined.

On a side note, this is one reason why I would contend that phone numbers (or a SHA256 equivalent) is not a good selector to use for Signal. It could easily be a privacy preserving custom field (that is then hashed) without accidentally sharing PII. This would also have the benefit of being able to reset the field without too much pain. Having to reset and get a new number is much more painful.

One last thing, has anyone else noticed that Signal seems to use an inordinate amount of data when _not_ using it? Once again, not clear to me why this much data transfer is needed. I just checked my phone and 359MB of data has been sent in the last 30 days. I use Signal sparingly (mostly because most of my contacts are not on it) and never a voice call over LTE. So I have no idea what is causing that much data to be transferred.

<comment><USER17> Signal for iOS desperately needs a new maintainer to replace Fred.

Here is the tracking issue for data usage.

[https://github.com/WhisperSystems/Signal- iOS/issues/866](https://github.com/WhisperSystems/Signal-iOS/issues/866)

<comment><USER15> They don't pay that well relative to the local market, insist you be in SF at the same time and only want full time. They can solve the problem by allowing remotes, having a few part timers or paying the SF standard salary. If you try to do a simple github pull request on the repo, it takes a very long time to do a code & design review so it makes possible maintainers discouraged from contributing.

It's the old choice triangle: fast, cheap, good: pick two.

<comment><USER17> Totally agree with you.

</comment></comment></comment></comment><comment><USER18> As Moxie notes, this problem is known as private set intersection: how can two parties P1 & P2 discover which elements they have in common, without revealing all their elements to each other or to a third party? His error is in describing scenarios where P1 is Open Whisper Systems and P2 is one of its users: yes, it would be insane to use a protocol where OWS must transmit its entire user database (hashed, encrypted or permuted) due to bandwidth reasons. But that's crazy anyway: OWS can see who is talking to whom on its servers already. Let's not do that!

The Right Thing is for individual users of Signal to privately compute set intersections between their own contacts. If Alice knows Bob, Charlie & Dan, and Bob knows Alice, Charlie & Eve, then when Alice & Bob add each other then they could each execute a protocol which would reveal that they both know Charlie.

In the last discussion of this, pbsd posted a link [1] to a great Microsoft paper covering private set intersection [2]. It works its way through a number of different protocols, but what it ends up with is this:

\- Alice generates three sets of dummy data D1, D2 & D3 (where the lengths of all three sets are equal to a security parameter t, and the items in the sets are invalid phone numbers (perhaps, elements of the form 'invalid:$RANDOM_DATA') and sends them to Bob securely. These dummy sets will be used to observe if the server is cheating.

\- Bob checks that they are well-formed (i.e., of the right length and invalid phone numbers).

\- Alice & Bob then generate a shared key K1 using a simulated coin-tossing protocol.

\- Bob then generates a shared key K2 with the server (in this case, the OWS server) using the simulated coing-tossing protocol.

\- Alice then sends to the server SHUFFLE{HMAC(K1, Charlie:1), HMAC(K1, Charlie:2), … HMAC(K1, Charlie:n), HMAC(K1, Dan:1), HMAC(K1, Dan:2), … HMAC(K1, Dan:n), HMAC(K1, D1_1), HMAC(K1, D1_2) … HMAC(K1, D1_t), HMAC(K1, D2_1), HMAC(K1, D2_2), HMAC(K1, D2_t)}, where n is another security parameter, Charlie is Charlie's phone number and Dan is Dan's phone number. Since the server doesn't know K1 and it doesn't know how the set was shuffled, it has no idea which of the hashes is which phone number, nor which is a dummy.

\- The server then generates a random SEED and sends to Alice KEYED_SHUFFLE(SEED, {HMAC(K2, HMAC(K1, Charlie:1)), HMAC(K2, HMAC(K1, Charlie:2)), … HMAC(K2, HMAC(K1, D2_t))}). Since Alice doesn't know K2, and since she doesn't know how the set was shuffled, she learns nothing yet.

\- Bob sends SHUFFLE{HMAC(K2, HMAC(K1, Charlie:1)), HMAC(K2, HMAC(K1, Charlie:2)), … HMAC(K2, HMAC(K1, Charlie:n)), HMAC(K2, HMAC(K1, Eve:1)), HMAC(K2, HMAC(K1, Eve:2)), … HMAC(K2, HMAC(K1, Eve:n)), HMAC(K2, HMAC(K1, D2_1)), HMAC(K2, HMAC(K1, D2_2)), … HMAC(K2, HMAC(K1, D2_t)), HMAC(K2, HMAC(K1, D3_1)), HMAC(K2, HMAC(K1, D3_2)), … HMAC(K2, HMAC(K1, D3_t))} to Alice.

\- Alice is know able to compute the intersection of the message she received from the server and the message she received from Bob. She does so, and sends the intersection {HMAC(K2, HMAC(K1, Charlie:1)), HMAC(K2, HMAC(K1, Charlie:2)), … HMAC(K2, HMAC(K1, Charlie:n)), HMAC(K2, HMAC(K1, D2)} to Bob.

\- Bob knows K1 & K2, and can calculate HMAC(K2, HMAC(K1, X)) for any X he knows (including the members of the three dummy sets D1, D2 & D3). He can now check that neither Alice nor the server has cheated. First, he finds the original X for each HMAC(K2, HMAC(K1, X)) in the intersection. Then, if any member of D2 is missing from the result, or if any member of D1 or D3 is in the result, then someone has cheated, or if he doesn't see all of Charlie:1, Charlie:2 … Charlie:n then someone has cheated. In this case, Bob knows that neither Alice nor the server cheated, and now he knows that they share Charlie in common.

\- Bob tells the server 'continue' and the server sends Alice the random seed used to in the KEYED_SHUFFLE; Alice uses this to determine which item she sent the server corresponds to which item the server sent to her, and from that which item in the intersection she sent to Bob corresponds to Charlie:1, Charlie:2, … Charlie:n, Dan:1, Dan:2, … Dan:n and so forth. Alice, too, can see if either Bob or the server cheated.

At the end of this protocol, Alice & Bob both know that they share a contact in common with the same phone number. In place of phone numbers, of course, one might use pseudonyms, public keys &c. They've sent relatively small messages (just a few times the size of their contact lists), and the server doesn't know how many they have in common, or whether they have anyone in common.

So, problem solved.

Edit: I should note that there's no way for Alice to know that Dan also has an account if they don't know any other user in common, and of course Bob & Alice need to exchange identities offline in person first. But, once that exchange has happened, everything else Just Works™ and due to the small-world phenomenon as more users use it, more users discover one another using it. Users who know one another can even re-run the protocol every once in awhile, when discovering new contacts.

[1] [https://news.ycombinator.com/item?id=7009674](https://news.ycombinator.com/item?id=7009674) [2] [http://research.microsoft.com/pubs/194141/sapsi2.pdf](http://research.microsoft.com/pubs/194141/sapsi2.pdf)

<comment><USER8> Despite this excellent explanation by wtbob, despite Moxie's blog posting, despite EFF, Snowden, Poitras, Schneider supporting it, I distrust Whispersystems for persisting Signal _must_ have access to the addressbook by refusing to work without. I tried it several times during the years, hoping they would have reverted this and allow usage without access to the addressbook. Everytime I deregistered again.

Today I will delete Signal from my devices because earlier this month Wire.com included PFS [0] _without_ requiring access to the addressbook. I'll start using Wire.com despite it not being fully opensource. Until now I was using iMessage and FaceTime Audio as they seem the most secure PFS solutions till date that don't require the addressbook to be uploaded. For some contacts I have no option but using WhatsApp which is quite a hassle without allowing WhatsApp access to the addressbook. From today I'll switch to Wire.com as it seems more secure than Apple's offering as Wire.com allows signature verification.

Regretfully Tom's Hardware [1] doesn't mention the addressbook in it's comparison-table neither mentions Apple's offerings. Neither does wikipedia [2]

Edit: found a German video-blog [3] that _does_ mention the Address book capabilities of Wire.com

[0] [http://www.reuters.com/article/us-dataprotection- messaging-w...](http://www.reuters.com/article/us-dataprotection-messaging- wire-idUSKCN0WC2GM)

[1] [http://www.tomshardware.com/news/wire-app-complete-end-to- en...](http://www.tomshardware.com/news/wire-app-complete-end-to-end- encryption,31389.html)

[2] [https://en.wikipedia.org/wiki/Comparison_of_instant_messagin...](https://en.wikipedia.org/wiki/Comparison_of_instant_messaging_clients#Secure_messengers)

[3] [https://www.youtube.com/watch?v=9kCsFjBuH0o&t=74](https://www.youtube.com/watch?v=9kCsFjBuH0o&t=74)

<comment><USER18> > Despite this excellent explanation by wtbob, despite Moxie's blog posting, > despite EFF, Snowden, Poitras, Schneider supporting it, I distrust > Whispersystems for persisting Signal must have access to the addressbook by > refusing to work without.

The mechanism I explained would permit Signal to work without uploading one's address book to the Signal servers. It would, of course, still require access to the address book itself in order to perform contact discovery. I personally don't mind allowing access to the address book itself; what I mind is uploading its contents.

<comment><USER8> > what I mind is uploading its contents.

You're correct that _uploading its contents_ is what it is all about for me. And why doesn't Signal use the new CNContactPickerViewController on iOS? But if I'm not able to verify the code, why does Signal _require_ access? If that is their business model, that is fine for Moxie etal but not for me.

@wtbob thanks for the clarification. I wonder what you think of Wire.com?

</comment></comment></comment></comment><comment><USER19> Why not share the contact list with the people on your contact list? Facebook demonstrated that most people don't have a problem with that and most people I want to contact are already contacts of some contacts that I have.

<comment><USER4> That's the goal. The problem is discovering it. If x has me on the list and I have x on the list, how can our two Signal apps discover that? Without telling the Signal server, and without telling random third parties?

<comment><USER20> > If x has me on the list and I have x on the list, how can our two Signal > apps discover that? Without telling the Signal server, and without telling > random third parties?

Take a look at the protocol documented in [https://news.ycombinator.com/item?id=11289223](https://news.ycombinator.com/item?id=11289223)

It's secure against an honest server and a malicious person, and against a dishonest server; it's insecure against a colluding server and person.

<comment><USER4> Fascinating algorithm. I wonder how many Signal users it would discover in the ~500 typical contacts, given one starting contact.

</comment></comment></comment></comment><comment><USER21> So, then, once everyone imagines they're safe in a totally private encapsulated world of secret hashes, then comes along a peer-to-peer initiative to target a brute force attack on the entire keyspace, using strategies not unlike the bitcoin blockchain.

</comment><comment><USER22> Can't you just make the hash more expensive?

Also, couldn't you regularly rotate salts?

<comment><USER23> Ten character alpha numeric rainbow tables can be had for only a few thousand dollars.

<comment><USER22> There cannot be precomputed tables for every custom hash computation. Especially an expensive one. Even less so if you add a salt.

It could be made prohibitively costly for all but the most determined adversaries - and those could probably get your social graph much easier from other sources.

Only problem I can see is it would take a few minutes after the app is installed to find your contacts..

<comment><USER24> You can't use a salt, the contact you want to match has to be able to compute the same hash.

You can hash the contact pair instead of one side of it, but even then an attacker can rent X instances of some hardware that is Y times faster than your phone, so if you target a difficulty of ~1 second per contact on your phone, you get a difficulty of 2700 hours / XY for the attacker to recover all of your contacts

So if Y is 10 times faster than your phone, you only need X=10 to recover the contacts for a given number in a day. If the attacker is willing to set X=1000, Y isn't even relevant.

<comment><USER22> > You can't use a salt, the contact you want to match has to be able to > compute the same hash.

I think the misunderstanding here is that I meant one salt for _all_ users at a time, instead of one salt for each hash.

And as long as stored hashes can be recomputed (by active users), the 'global salt' can be rotated over time.

We can pre-compute hashes with future salts in case apps are not constantly online. Then we could rotate salts, say, once every 2 hours.

The point being to make rainbow tables more expensive.

> You can hash the contact pair instead of one side of it, but even then an > attacker can rent X instances of some hardware that is Y times faster than > your phone, so if you target a difficulty of ~1 second per contact on your > phone, you get a difficulty of 2700 hours / XY for the attacker to recover > all of your contacts

> So if Y is 10 times faster than your phone, you only need X=10 to recover > the contacts for a given number in a day. If the attacker is willing to set > X=1000, Y isn't even relevant.

I think this should be (10^10/3600 ~ 2.7 million hours) / XY. Also, let's say we can make it Y seconds (perhaps the hash is memory hard, etc). Then to compute a single table (per salt) we need 2.7e6 hours, at say $0.01 per hour, so $27k per table.

Taken together that would mean to reveal the contacts of signups happening within a 2 hour window, would cost quite a sum.

It's not secure, of course - but it does give some measure of privacy.

If you think users are willing to wait more than an hour, you could 10x the cost too. But that's probably not practical anymore!

Edit: Oh. I see I made a mistake here! If the server computes a single rainbow table it will be able to retroactively de-anonymize all users that are already active at that time! :( Sorry.

<comment><USER24> Yeah, somehow I missed a couple of zeros, it would be 2.7 million.

Such a salt wouldn't tighten up the window though, for contact discovery to work, all the outputs have to be available to whatever is doing the matching.

<comment><USER22> OK hold on. Say the rotating salt thing doesn't work, for whatever reason.

But you yourself made a better suggestion! If we do hash (phone #) contact pairs, and every client publishes multiple hashes, one for each of its contacts, then a cheating server would need to compute (max) (10^10 * 10^10)/3600 ~ 2.7e17 hours worth of hashes.

That would actually be secure, no?

Edit: messed up the math myself this time; I think this is correct now though

<comment><USER24> For the contact discovery to be private, the phone has to calculate the hash. So the server cost also depends on the performance differential (many entities would likely still spend $50,000 to discover the contacts of a high value target).

Adding information increases the cost, but it also reduces the likelihood of a match.

You've edited your comment since I wrote the above. Anyway, if the attack is directed at a single user, there's only one 10^10 involved (and really, the phone number space isn't that big).

<comment><USER22> Really sorry about the edits! Thinking in real time :)

So about the size of the phone number space. Interestingly I guess you could at least limit it by country. But, unless you already know the mobile phone numbers of the target's acquaintances, (in which case there is no real danger of 'leaking' your social graph), you can't really limit it more, because mobile phone numbers are pretty random within each country's phone number space (I think).

So say the US has at least 0.5 billion assigned mobile numbers, and you don't know which are assigned, so the space could easily be 10^10 for just the US. (I can't find any quick numbers on Google right now).

But even if we go down to say, 100 million, we would still get (10^7 * 10^7)/3600 ~ 2.7e11 hours worth of hashing to get all contact pairs. Which is still secure.

Now as far as limiting one end point to a single phone number - that would be a special case. I'm not sure if this isn't moving the goal post a bit.

As long as the server does not have access to your own phone number, it, or anyone who has hacked into the server, cannot really use that to limit their computations. Unless they are already targeting you through other means (possibly you are a person of interest to someone), and so know your phone #.

In that case yes, they could reveal (part of) your social graph for a (maybe) affordable cost. But in that very special case, I think we are dealing with nation-state adversaries.

And in that case, the telcos probably already have a list of your phone # contacts. So it would probably be easier to simply get it from them.

The only thing left to be revealed would be that you communicated with a specific acquaintance _using that particular app_ , at some particular time.

So a targeted attack could leak that metadata.

It's not perfect.. but I think it might just be good enough for most users.

If we go off the deep end with an attack tailored to a single phone #, we also have to worry about a whole lot of other attack vectors that are probably more important.

Lastly, note that the user (if sufficiently paranoid) could simply opt out of the automatic contact search post-install.

<comment><USER25> As for mobile phone numbers being randomly placed inside larger space of all phone numbers, while this makes some sense for US/NANP, in most of the rest of the world mobile numbers have some semi-well defined prefixes (as in "number that starts with 6 or 7 is certainly mobile phone, discerning what operator is sligthly non-trivial") and even for NANP there probably is some publicly available database that says whether given number is mobile or not.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER26> > This would be a great problem to really solve well. If anyone develops any > insight into a practical

> privacy preserving mechanism for achieving this type of contact discovery, > or notices something

> we've missed, please let us know here, on twitter, or on our development > mailing list.

> – Moxie Marlinspike, 03 January 2014

This idea is probably full of holes, but there might be something useful here...

Could you use layered system of bloom filters of shards of the hash(telno) space?

(Figures are made up, but are roughly the right order of magnitude for millions of service users.)

The filters could be made smaller, at the expense of having more of them.

Layer 0 is a 1MB bloom filter with a 10% error rate, for _all_ hashes of telnos

Layer 1 are 16 1MB bloom filters with 1% error rates, sharded by the last nibble of the telno's hash

Layer 2 are 256 1MB bloom filters with 0.1% error rates, sharded by the last byte of the telno's hash

Layer 3 are 4096 1MB bloom filters with 0.01% error rates, sharded by the last 12 bits of the telno's hash

...

A newly installed app uses the following algorithm to determine which of its contacts are already users of the service, without disclosing the phone's contact list to the service:

The app makes a copy of the list of contacts' telephone numbers (E164 format).

Request the L0 bloom filter. Using L0, 90% of non-member telnos are removed.

Request only the required L1 shards, for the remaining telnos. Using the necessary L1 shards, more non-member telnos are removed (99% are gone now).

Request only the required L2 shards, for the remaining telnos.. Using the necessary L2 shards, more non-member telnos are removed (99.9% are gone now).

Repeat until required error rate is reached. i.e. The list only contains telnos of other service users.

The benefit of this method is that bloom filter shards are only requested for numbers which are _probably_ service users, thus disclosing much less information to the service provider.

90% of contacts' numbers will never be used to request a Layer 1 bloom filter, and those that are, will only disclose 4 bits of the hash to the service provider, narrowing them to 6% of the worlds telnos.

99% of contacts' numbers will never be used to request a Layer 2 bloom filter, and those that are, will only disclose 8 bits of the hash, narrowing them to 0.4% of the worlds telnos.

99.9% of contacts' numbers will never be used to request a Layer 3 bloom filter, and those that are, will only disclose 12 bits of the hash, narrowing them to 0.02% of the worlds telnos. (240 million telnos, if there are 10 billion telnos, as per the webpage.)

<comment><USER23> The server can cheat.

If I provide an L0 with numbers that begin with `1` and you don't download an L1, I learn you don't have any numbers that begin with `1`.

Facebook says they get 5 new profiles every second[1], so it may be justifiable to query too often.

[1]: [https://zephoria.com/top-15-valuable-facebook- statistics/](https://zephoria.com/top-15-valuable-facebook-statistics/)

<comment><USER26> Good catch. This is a weakness, but it may not be relevant to WhisperSystems' use case.

If you provide an L0 with numbers whose hashes end with '1' (hex), and I don't request L1/..1 shard, then you learn that I don't have any numbers whose hashes end with '1' (hex).

I have 1024 contact telno hashes.

Assuming I request only when the app is installed, and daily after that, it will take you:

16 days to learn which final nibbles my contact hashes have - probably all of them.

256 days to learn which final bytes my contact hashes have - probably all of them.

4096 days to learn which final 12 bits my contact hashes have - <USER2> around a quarter of them.

Three years in, you know which 900-1024 of the 4096 12 bit combos match the last twelve bits of one or more of the telno hashes.

~950 * 4096 = 15,200 days to learn the final two bytes of hashes, of which there will probably be ~1000 unique values.

You now know 1000 buckets of 6 million numbers which contain one or more numbers from my contacts.

If you update the app, over the air, to query every second, this would take just a few hours. But then, you could just update the app to grab all my contacts and send it instantly.

The "server cheating" is a valid attack, but it may not be important, as there are easier attacks if we assume a malicious service.

I assumed that WhisperSystems were _trying_ to limit the information they had, as a good actor, rather than ensuring complete app safety vs a malicious service provider.

i.e. their motivation is not to have the information to turn over, rather than to not be able to get it when compelled to modify their app. This is an important legal distinction in some jurisdictions.

<comment><USER27> I think it's a bit worse than that. Suppose the server wants to learn whether you have a certain number in your contacts.

Then they simply put that number into your lower-level Bloom filters for L0, L1, L2, ... even if that number is not really a member of the service. To prevent a final match, they only need to keep the target number out of the final BF.

Then they passively watch which BF's you retrieve at L1, L2, ... etc. If you never retrieve the BF for Ln, despite the bits for the target number being present in the L(n-1) Bloom filter, then they know you don't have the target as a contact.

Does that make sense?

Of course, this attack and the previous one both go away if we assume the server is "honest but curious".

<comment><USER26> That makes sense, but any malicious service could pretend that a particular telno was a user of the service, in order to see which users had that contact.

I'm assuming the objective is to minimise the service's unnecessary knowledge of non-service-user contacts.

<comment><USER27> > I'm assuming the objective is to minimise the service's unnecessary > knowledge of non-service-user contacts.

Right, so an honest-but-curious adversary model sounds like it's a good fit for the server. Then all these attacks where the server lies about something are out of scope.

Again, I like this idea so I think it's worth thinking about it some more. Not trying to nitpick here, just trying to help think through what you can do.

What about the clients? Do you want to limit what they can learn?

Given any telno, a client can quickly tell whether that telno belongs to the service, even if the client doesn't really have that number in its contacts. Does that matter? I guess we come to a sort of meta-point here. What does it mean for a number to be in someone's address book? Anything? A fundamental part of the problem seems to stem from trying to make this work with identifiers that come from a (cryptographically speaking) very small space.

Extending the attack above, really the client can get a pretty decent approximation of the entire list of telnos in the service. If he checks all 10 billion telnos against the BF for L0, he gets a list that includes all subscribers and several false positives -- each number in the list is only 90% likely to be a subscriber. If he wants to refine his estimate for the likelihood that any given number is a subscriber, he retrieves the corresponding BF for L1. So he starts with a decent estimate of the subscriber list, and with each BF that he downloads, is estimate improves. How bad is that? I'm really not sure...

<comment><USER26> The number of downloads required to get each additional nibble is 16 times that of the previous nibble.

<comment><USER27> Also -- I was too sloppy in my earlier analysis, and as a result, my numbers could be _way_ off. The attacker might learn much less than I initially thought. It depends on how many users are subscribed to the service.

After the client downloads the BF for L0 and hashes the entire space of 10 billion telnos, he knows 90% of the non-subscribers for certain. All the telnos that matched in the Bloom filter are either (a) subscribers of the service or (b) false positives from the BF. Let's say there are n subscribers. Then the attacker gets a total of n + 0.10 * (10^10 - n) hits on L0. The likelihood that a matching telno is actually a subscriber is n / (n + 0.10 * (10^10 - n)).

So he learns something with each level of the Bloom filter, but getting to 90% certainty may require retrieving several levels of the BF.

<comment><USER26> Thanks for your questions and analysis.</comment></comment></comment></comment></comment></comment></comment></comment></comment>


Ask HN: How do you measure the success of your startup? - <AUTHOR>

Is it the number of users you have using your web app or is it the amount of money you're making? How do you know when it's time to pull the plug on your startup? <comment><USER2> we measure the success of our startup by the amount of social and environmental good we are generating.

the time to pull the plug is a good question. we are nearing our second year, though only in the past 4 months have we both been working full time. as the product and community matures we will either transition from savings to sustainability, or else move to more sustainable work while still pushing the startup forward on the side (not so many new features, but often the social and entrepreneurial advances are more a matter of timing and connections. constant strategic effort, not full time effort). we'll see though.

</comment><comment><USER2> we measure the success of our startup by the amount of social and environmental good we are generating.

the time to pull the plug is a good question. we are nearing our second year, though only in the past 4 months have we both been working full time. as the product and community matures we will either transition from savings to sustainability, or else move to more sustainable work while still pushing the startup forward on the side (not so many new features, but often the social and entrepreneurial advances are more a matter of timing and connections. constant strategic effort, not full time effort). we'll see though.

<comment><USER2> sorry for the duplicate. i posted just as hn went down. as i clicked a second time i wondered whether it checked for double posts (no duplicate siblings). guess i have my answer.

i don't see a "delete" option, though i've seen '[deleted]' before. maybe that's from moderators.

[EDIT: so I see the 'delete' option for this comment. must disappear after time passes.]</comment></comment>


Civilizing the Barbarians Lecture 1: Introduction [video] - <AUTHOR> https://www.youtube.com/watch?v=c9BQnpaI58I&list=PLHxtyCq_WDLXzT_CgYPtjYab8fyd2PkjB <comment><USER2> For context: [https://psoberoi.github.io/stepanov- civilization/civilizatio...](https://psoberoi.github.io/stepanov- civilization/civilization.html)</comment>


How does a site find you are behind a VPN? - <AUTHOR> Is it possible to find if you are behind a VPN? <comment><USER2> There are a large number of ways to unmask visitors using a vpn or even tor, you can use dns requests to do it, javascript, vpn log access, isp access, cookies, browser history, search queries, time attacks, webrtc, google chrome, ads...

</comment><comment><USER3> My best guesses are that there are patterns that pop up from the IP addresses of VPN connected users that give it away. Weird devices, weird timezones, the more popular the website the more people from the VPN will be connecting and the more obvious it will be from the sheer numbers.

But those VPN IPs are not secret, if I can download a list from of damn near every internet ad server and block the vast majority of ads, it wouldn't surprise me is there was a list out there of VPN IPs.</comment>


Virgil Revisited - <AUTHOR> http://www.nybooks.com/articles/2017/11/23/david-ferry-virgil-revisited/ <comment><USER2> I'm reading the Aeneid right now, the Fitzgerald translation, right now. It's good but the poetry isn't as enthralling as I found the Iliad and the Odyssey.

One aspect I found really interesting was how Virgil was claiming Trojan heritage for Rome. I don't think that claim has any factual basis, but I haven't researched it. Another interesting aspect is how it's a vehicle for promoting religious and cultural behavioral norms. Occasionally Virgil steps out of the narrative briefly to praise or condemn someone for following or breaking behavioral norms.

<comment><USER3> Well it was basically a piece of propaganda for the Roman government. A really beautiful piece of propaganda, but propaganda nonetheless.

The Trojan heritage of Rome isn't true in fact, but it certainly has some truth metaphorically. Rome was always an heir to Hellenic culture and nowhere is this more evident than in Roman art. Homer was the pinnacle of artistic achievement at that point in history, so it made sense for Virgil to model his poem on the Greek epics.

</comment></comment><comment><USER4> I first thought it's about this Virgil: [https://virgil3d.github.io](https://virgil3d.github.io)

<comment><USER5> Please don't do this here.

<comment><USER4> Do what here?</comment></comment></comment>


Show HN: Article on causal inference applications in industry - <AUTHOR> https://georg.io/the_causality-driven_company <comment><AUTHOR> Hi to anyone reading this. This is my first attempt at describing applications of causal inference in the context of possible industrial applications.

I started this article because I often find commonly used examples from economics and medical research hard to relate to.

Both my understanding of this topic and my article likely need further work so I would appreciate any constructive criticism!</comment>


Show HN: iPhone app to track security vulnerabilities and patches for software - <AUTHOR> http://stackwatch.net

<comment><AUTHOR> We've struggled to gain any sort of traction with our 1.0 release. We just brought out 1.1 and were looking for comments/feedback as to how to improve our execution. Any and all feedback would be greatly appreciated.

Here are some codes to get the app for free: YE7PL6X4KR37 FK74FX6L47MJ 4KFFK3AEANA4 P73TXMTW9JLN A7AJYH76WTT6 6PKF4EEFMA6A MHLX3PRPYAJ9 N39YFP7LXLK7 KEPFHYR6KYRL YMYEAY67TX66 N63WWTTFNLPE 6KYWP4EH4T9H YJ3K666HH3YA T9N76F9R6NRH W6PYLPXM97M6

</comment><comment><USER2> No love</comment>


Python 3 ... - <AUTHOR> http://mail.python.org/pipermail/pypy-dev/2013-May/011394.html

<comment><USER2> The same functionality in Perl: [https://www.inkling.com/read/programming- perl-christiansen-4...](https://www.inkling.com/read/programming-perl- christiansen-4th/chapter-4/the-ellipsis-statement)

It's a fun feature but saying it's the main reason to upgrade to Python 3 is going a bit far. I don't see how it's much different to something like # TODO: implement this method! or raise NotImplementedError if you don't want it to be invoked.

<comment><USER3> It's sarcasm. You can tell because of the "Even worse" and "</rant>".</comment></comment>


Epic freshman convocation at Georgia Tech - <AUTHOR>

http://youtu.be/98nNpzE6gIs <comment><USER2> Yeah...it's a pretty awesome place to have gone to school.</comment>