Most children are happy, but material deprivation catches up eventually - <AUTHOR> http://qz.com/405960/most-children-are-happy-no-matter-what-but-materialism-catches-up-eventually/ <comment><USER2> Notice that this changes right around the age of puberty. Having grown up quite poor, my hypothesis is straightforward.

Before you are a teenager, the things that make you happy and that you value are largely disconnected from money. Happiness is more about the environment not being pathological more than it is about having material goods. Children invent their own happiness.

As a teenager, it becomes about the mating ritual. In that context, relative material deprivation can have a significant adverse impact on the ability to attract a quality mate. I would expect that in countries where it is relatively easy to change your material position in society would have happier adults than one where there was less opportunity because it gives the person more ability to improve their outcomes on the mate selection front.

<comment><USER3> My anecdotal experience as a suburban American completely supports this explanation. I attended public schools with a variety of income levels represented. I didn't notice I was poor until I was about 13 years old and realized that I couldn't afford fashionable clothes. I would buy the brand that kids were wearing, but I only had two or three outfits. I was astonished that some of my peers would wear the 'cool' brand, but have different clothes everyday.

<comment><USER4> A major reason why I'm for uniforms. Take all that petty cool clothes envy out of the equation.

<comment><USER5> If it's not clothes, it'll be watches, shoes, smartphones, underwear, hats, notebooks, whatever. Uniforms aren't going to stop teenagers in the midst of puberty from competing with each other for status.

<comment><USER6> If every material thing get removed, you think it will end up as a competition through physical and intellectual qualities ?

<comment><USER7> Or arbitrary social bullying, like we have today.

</comment></comment></comment></comment></comment></comment><comment><USER8> _However, the material deprivation seems to catch up eventually. If you compare the relative rankings of children's reported happiness with their grown-up counterparts (pdf), the results change significantly._

Woah... what a leap. You really couldn't think of anything else that might affect an adults happiness other than materialism?

Edit: Just checked the PDF.. it's the World Happiness Report. It does not say what the article says.

<comment><USER9> I agree. I think this is one of those "correlation doesn't necessarily equal causation" articles. I'm sure _some_ of it has to do with material items, but I can't help after reading some of the comments here (markyc's comment on Romania, for instance) that there are far more things at play: Cultural values, adulthood stresses, etc. Not every culture places a strong emphasis on material goods, and not every culture that is strongly materialistic is made happy by material assets.

Out of curiosity, I had a look at some of the metrics on Wikipedia for comparison. Colombia ranks 4th according to the adult "happiness index" (after Germany) but 80th on the inequality-adjusted human development index and 98th on the standard HDI--compared to Norway which ranks 1st in both metrics. I can't say I know what this means, but from what I understand, I'd imagine that countries higher on the HDI index therefore have more equal access to services adults find important (like healthcare) and more equal income (and therefore purchasing power) and "should" be happier. Likewise, these countries ought to have greater access to material goods. (But, there's also the issue of who they interviewed, their income levels, etc.)

I could be _completely_ wrong, but I just can't imagine that owning a plethora of _things_ necessarily equates to increased happiness.

</comment></comment><comment><USER10> Could it be that children are just happier than adults, regardless of their material assets. Adults have responsibilities and stresses that children do not - and that is probably more of a causation than their material assets.

<comment><USER11> It could also be that happiness is strongly dependent upon where you stand relative to the people around you. Children don't compare themselves to much other than the immediate family, village, or neighborhood; they just don't have the life experience to know how people in different cities throughout the rest of the world live. Adults have had time to absorb cultural messages of inferiority: these are all the things that your counterparts in America do that you're missing out on. (Never mind that the Hollywood messages broadcast around the globe tend to cherry-pick the most glamorous, outrageous lifestyles and display them as normal.)

It takes a lot of deliberate mental practice to learn not to care about what others have or what they might think of you, and few people bother.

<comment><USER12> _It takes a lot of deliberate mental practice to learn not to care about what others have or what they might think of you, and few people bother._

Yes. We teach children to brush their teeth to avoid cavities. Maybe we should also teach them to brush their minds to avoid anxiety.

<comment><USER13> > Maybe we should also teach them to brush their minds to avoid anxiety.

Isn't it children that should be teaching _us_ about that? :)

<comment><USER14> Too bad it's mostly driven by marketers trying to make us more anxious about what we don't have.

"Don't have the newest Timmy the Dinosaur toy? Your parents don't love you any more!"

<comment><USER15> As a parent with a 5 year-old and a 14 year-old, I assure you that the word "no" is quite effective.

<comment><USER11> Even better is "See all those commercials in TV? They're all created by people trying to tell you what to do. You don't like being told what to do, right? So why let a stranger who just wants to make money off you tell you what to do?"

My parents gave me that speech when I was 5, before I was allowed to watch any non-PBS TV. It was remarkably effective; I just tuned out all the commercials, because I knew they were people trying to sell me things that I didn't actually want before I saw the commercial. It got so extreme, at one point, that my mom had to go the other way and say "Y'know, it's okay to spend money once in a while."

<comment><USER16> I will take your advice to the heart. It really speaks for the quality of the community here, to speak about marketing and advertising and its deplorable influence on the young developing mind.

And I say that because I have been there. I have been anxious, unhappy because of material posessions, wanting everything that is displayed vividly in glamorous ads.

And it is a bad place to be. I'm 22 years old and now I'm cured. It's been quite a journey to regain independent thought.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> Random thoughts on the subject

"Happiness" and "Confidence" are two of the most dangerous words in American Culture. I really wonder who benefits from this.

On Culture

Until the age of 19, I was in Western Africa. In our language there is no direct substitute for the question "Are you happy?" I can ask "are you sick, hungry, lost, fast, slow, smart, bad, good, angry,etc..," but I have no easy straight way of asking "Are you happy?"

That is not to say people are happy, that is just to say the words/questions shape the culture.

On Material Deprivation

On the other hand I noticed the difference between my status and my friends. I had friends I would not bring to my home as a kid; these kids would spend on clothes what was our family's monthly income. Material deprivation is entirely subjective nevertheless. I also had cousins, family friends, who found our home the best place to be during their holidays. They would usually live in more remotes part of the country or in the suburbs, not the main city.

On Material Deprivation

"Appearance starts where performance ends." I notice the times one finds hope or purpose bigger than themselves (even if temporarily) they do not care so much about appearance. Take the average startup entrepreneur. They could live in a shack and be content if they were confident they had the next Facebook in hand. On the other hand they could land a job at Google for $250k yearly and be miserable because their goal was to build a unicorn. To this end whenever I worry about appearances, I know internally something is lacking. Something deeper. It happens on and off, I realize it.

"Ignorance is really bliss"

I have noticed something: philosophers and analytical minds seem unhappy, religious minds seem just accepting, and those who "do not appear" very intelligent are having a freaking good time in life.

<comment><USER13> > I have noticed something: philosophers and analytical minds seem unhappy, > religious minds seem just accepting, and those who "do not appear" very > intelligent are having a freaking good time in life.

Which begs the question: who _really_ are the smart ones? :-)

Smarter people might have a tendency, more than others, to brood and worry over existential questions and matters that happen to be depressing. But worrying about things that are out of their small hands isn't exactly productive, or smart.

<comment><USER17> _But worrying about things that are out of their small hands isn 't exactly productive_

Or it may seem, but I believe the reason we make advances in almost every field is due to philosophy. "Philosophy proposes and Science creates a framework for discovering answers."

But I agree, it begs the question "who is really smart?"

<comment><USER13> There is a difference between philosophy in general and thinking and pondering over nihilistic thoughts about existence itself that make you depressed. "There is no point to life, and that makes me deeply sad. I can't do anything about it since I am just an infinitesimal speck of dust in a vast universe, but I intend to take this train of thought to the point of alcoholism and despair nonetheless". That kind of thing.

The guy from True Detective comes to mind.

<comment><USER17> I agree with that. Both types of thinking lead to unhappiness with the difference that one attempts to find answers while the other does not.

</comment></comment></comment></comment></comment><comment><USER18> Almost half of Romania is still rural, so growing up is awesome (farms, animals, free range everything)

Adults don't have it that easy in the country side

</comment><comment><USER19> So many confounding factors. Culture and social pressures pay a large part in how happy adults will claim to be.

</comment><comment><USER20> Well I can definitely count as being happy as a children, and quite often depressed as an adult. But material deprivation doesn't explain that, at all. As a child/teenager I could be happy just playing around (outside/legos/video games). Now I'm just like "what's the point?" or generally getting bored really fast about pretty much anything and just wondering about the meaninglessness of life.

<comment><USER21> My view is that kids are exploring and loving the world. Adults are support mechanisms for kids (and elderly). But we have been stripped of community and if you happen to not have kids, you can be even more isolated. Being around (free) kids is a great way to feel meaning in life.

Adults are driven by our evolution to be useful to the community. Games are designed to allow humans (particularly kids) to master skills. Adults ideally should have already mastered much of the needed skills. Hence games cease to be interesting the more one gets older (in general -- there are always plenty of exceptions).

<comment><USER22> For your insinuation that adults can only be happy if they have children, you can kindly go fuck yourself.

<comment><USER21> I said around children, not having children. The two are completely disjoint. I know lots of people who have children but are not actually around them and are miserable. Conversely, I know people without children who are surrounded by the happy little critters and have a deep sense of fulfillment.

Being around children teaches you a compassion for others and yourself, something your comment points towards a desperate need for.

</comment></comment></comment></comment><comment><USER23> Since the last part of the brain to mature is the prefrontal cortex which involves planning; perhaps adolescents simply can't imagine long enough into the future to under stand why they might want so much money and stuff, whereas an adult would be considering retirement and worrying about longterm stability.

</comment><comment><USER24> It sounds like [http://en.wikipedia.org/wiki/Economic_mobility](http://en.wikipedia.org/wiki/Economic_mobility) versus [http://en.wikipedia.org/wiki/Social_mobility](http://en.wikipedia.org/wiki/Social_mobility)

</comment><comment><USER25> I wonder how children emotions were in the early 1800s, then. I wonder how it affects things.

</comment><comment><USER13> I've long wondered about whether adults really aren't wiser than children. Smarter, yes, but the _wisdom_ might be largely a blob of limiting and pessimistic beliefs. And a very _fragmented_ wisdom: adults argue and wage wars over the right ways to live. And if we aren't condemning others for their lifestyles and views on life, it might be because we are too busy trying to find our own purpose and path.

Does it really take a lifetime to gain _wisdom_ about life? Or is it adults that unlearn the wisdom of childhood, and forever after that struggle to find _wisdom_ in an adult paradigm which is fundamentally flawed?

<comment><USER26> Sounds like you're asking abstract questions instead of concrete ones. The concrete questions will have concrete answers and you can go from there.

With abstract questions, you can sit around wondering for eternity. Unless you come to recognize that you're not getting anywhere (life will remind you soon enough) and do something concrete instead :)

If you replace wisdom with 'competence' it becomes much more down to earth. When somebody else is feeding, clothing, scheduling, teaching etc and all you have to do is use your base instincts, it's easy to be competent, you don't need to do anything.

When you have to feed, clothe, schedule, teach etc yourself AND others AND then some, it can be quite a challenge.

Children are not competent at much of anything, so there you go :)

<comment><USER13> Abstract questions are great when you don't quite know what to hone in on, so that you don't get prematurely bogged down in specifics. Specifics which might be superflouous to your question, or maybe even misleading. They are also great when you want to have a general conversation with a general crowd, where more broad and general questions and topics can facilitate more discussion with several people, whereas more concrete, opinionated and assumptious questions would only attract a few others if anyone. As for myself, my own suspicions and enquires are a bit more focused and opinionated than you might get the impression of here.

As for asking more concrete questions in this place, I see little point. At least as far as your benefit is concerned since you know everything on this topic already.</comment></comment></comment>


My own private Internet: .secure TLD floated as bad-guy-free zone - <AUTHOR> http://arstechnica.com/security/2012/05/my-own-private-internet-secure-tld-floated-as-bad-guy-free-zone/ <comment><USER2> So, let's see. For an inflated price, you get a domain name which has a vastly more complex application process, which places arbitrary restrictions on what services and configurations you can run under it, which mandates periodic security scans (probably at your own cost), and which retains the right to seize your domain, possibly permanently, if you don't comply. Oh, and you end up with what is ultimately a less memorable and more difficult to type domain name.

With features like this, how could you say no?

<comment><USER3>
      No.
      Nope.
      No thanks.
      Not at this time.
      No way, Jose.
      Never.

<comment><USER3> Since it's too late to edit or delete the parent to this comment, I sincerely apologize for attempting to make a joke on hacker news.

<comment><USER4> HN is fairly intolerant of any kind of humor, I've found (unless it's the snarky kind). I've been downvoted more than once for trying to crack a joke, in fact I don't even forsee this post faring well, even though it's an attempt to inform someone else of a valid point.

<comment><USER5> The HNers for Humor Coalition wishes you well. From both of us.

</comment></comment></comment></comment></comment><comment><USER6> From a marketing perspective, this actually seems pretty clever. I could see a lot of people wanting to use "citibank.secure" or "amazon.secure" or "gmail.secure", just from the way it sounds. It's the first TLD I've ever come across that feels it could actually compete with .com.

Of course, the first time one of the sites gets hacked, who knows what will happen to the TLD's reputation...

</comment><comment><USER7> This sounds great, but it's not really a solution to the hard problems with crypto. The single biggest impetus to a fully encrypted internet is not a technical barrier, but the fact their are too many competing systems and standards, all with different drawbacks, but generally all of which give terrible UX. For an encrypted web to become ubiquitous, there will need to be a set-it-and-forget-it solution that requires minimal input from the user and which doesn't reduce functionality.

Using .secure just asks users to instead place their trust in a new central authority; why does this even need to be a new TLD? This researcher is wasting money buying into ICANN's bullshit monopoly. The future of strong crypto systems will most certainly be decentralized.

<comment><USER8> Howdy, that article is about me, and I do agree that crypto trust systems need to become more decentralized. People seem to be reacting to the story without looking into the technical details, so I'll try to avoid <http://xkcd.com/386/>, but I will say that one of our goals with Domain Policy Framework (which we will release a draft of tomorrow) is to create the policy and identity that, combined with DNSSEC and DANE, allow for more granular (but not completely decentralized) trust relationships.

I think we agree about UX. One of the big picture goals of .secure is to invert the current security experience. These days you go to a site and then have to interpret the UI to see if you are safe. In our vision, when you type bank.secure you are telling your browser, OS and the server on the other side that you want to navigate there as safely as possible.

I'm going to post about the tech details more tomorrow and hopefully that clears some things up.

<comment><USER9> I guess we'll have to wait until you post the technical details, but from the Ars article, it sounds like this page is using existing standards (TLS, maybe some other stuff). That's fine, but what's the incentive for a bank or any secure online service to use this instead of the expected <bank>.com domain name?

When I browse to a secure page (https) in my browser, I'm told that the connection is secure with a green https prefix in the address bar. But I don't really know it's secure. I'm placing my trust in the CAs. Using .secure to signal a secure connection to user doesn't improve this. It just complicates things further, because now there's two things a savvy user should look for if he/she expects a secure connection (https and .secure).

Because you seem like a fan of XKCD: <http://xkcd.com/927/> Creating a new UI standard works best when it kills (totally replaces) it's predecessor. In this case, I think that translates to having every site which currently uses https make the switch to .secure. That seems unlikely to me.

<comment><USER8> The UX should be the equivalent of the current EV UX, but the point is that if your browser supports DPF then you don't need to look. If you got there after typing bank.secure, you should be good. If the screen is red (and hopefully doesn't have an "accept this risk" button) then you didn't.

I should point out this is about more than TLS, and more than the web. We have a short window during which we can create an Internet category that is both clear to the user in it's goals and specific in its requirements for hosts. Our hope is to create an extensible protocol with DPF, one that can be extended to give domain registries and registrants the ability to choose higher privacy protections, limit risk to CA compromise, and secure other protocols like SMTP.

</comment></comment></comment></comment><comment><USER10> > _sites could specify which authorities are or are not allowed to sign their > SSL and TLS certificates_

This idea actually sounds fantastic. If I only ever buy my certificates from one or two CAs and if I can disallow certificates signed by other CAs, I won't have to worry about some random CA getting hacked and millions of fake certs being trusted by browsers.

Implementing this scheme, on the other hand, will be tricky. If I use a DNS record to specify my trusted CAs, sort of like how we do SPF nowadays, anyone who can hijack DNS queries will also be able to forge that record. Proper DNS security must be provided before this measure can be made effective.

</comment><comment><USER11> The beauty of the Internet is low barrier of entry for startups with potential. If .secure becomes popular among big guys, startups with similar features will be disadvantaged.

The complicated paperwork will not only drive phishers and scammers away. It also excludes people with little capital but a genuine intent to do business. We already have these barriers:

\- Extended Validation SSL

\- Merchant Account (including PCI compliance)

\- All kinds of trust seals

The cost of these products can be several thousands of dollars every year and they have become pretty much a must-have for anyone who wants to be trusted more easily.

.secure will just impose another barrier, unfortunately.

<comment><USER12> If you're looking for secure payments, you can always direct customers to a .secure payments handler, in much the same way that Paypal does already. The whole domain wouldn't have to operate under a .secure domain, in fact that would be undesirable as it would diminish the importance of it customer's eyes if every major website is on a .secure domain.

</comment></comment><comment><USER13> This type of scheme comes up what, every year? Except this time somebody sunk $9 Million into it?

Guys. Listen. .com is, has been, and always will be _the standard_. It's the brand name. It's the default.

There is never _not_ going to be a chase.com. It will either be run by JP Morgan Chase, or it will be run by a scammer, either way the overwhelming majority of internet users will think "chase" and associate "chase.com" with it.

Imagine a non-technical family member getting a phishing email with chase.com in it. Do you honestly think that they're going to think to themselves "bah! the .com tld isn't secure! I should be looking for a .secure website!"

What is even the point of this? Regardless of if people jump on to .secure, the entire .com internet still exists.

<comment><USER14>
      Do you honestly think that they're going to think to themselves "bah! the .com tld isn't secure! I should be looking for a .secure website!"

I don't agree. I've seen people decline to do online business because the payment page wasn't https. This was not that tech savy of a person, and it actually impressed me. People adapt quicker than we realize.

<comment><USER15> I agree, putting https on an ecommerce site actually does increase conversion. Even a silly ' this site is secure' increases conversion, so people do notice and care

The problem is the classic tld one. With https you know it's the same domain, but who's to say chase.secure is run by the same people as chase.com? Both could own a trademark relating to the word chase, both have verified (and different) addresses, but they're not necessarily the same

I know it ruins the tld extortion model, but I think for this to fly the .secure address should be linked to .com, so only the owner of the .com is eligible to buy the .secure and has been vetted as owning it

Otherwise I'm pretty certain the consumer uncertainty of the tld issue will destroy all trust in the .secure brand. No one argues that https is less secure, but when people have their geek friends put caveats on the .secure domain that they don't quite understand, I think that consumers will eventually avoid it

</comment></comment></comment><comment><USER16> This + RFC 3514 (<https://www.ietf.org/rfc/rfc3514.txt>) will make internet secure!

<comment><USER17> That RFC was the first thing that came to mind for me...

some folks will read ".secure" as ".pwn-this-i-dare-you" and it will happen eventually unless you air-gap any ".secure" machine from the "real" web. This idea is about as effective as the evil bit RFC imho, just less funny.

<comment><USER18> You say this like it's a bug, but it's a feature. Your servers don't get hardened by being ignored, they get hardened by being under continuous assault. The ignored servers are the ones the hackers waltz into with an exploit patched by the vendor six years ago.

</comment></comment></comment><comment><USER19> A gated, centralised and unscalable Internet community whose lofty goals are directly undermined by cost and the core principles of security: weakest link.

Also, I cannot see how they could achieve critical mass without government intervention. I expect if they really do mean business to see some intense political lobbying or sidedoor via some government regulator or commission. It could even be that the intelligence services will love and push for this proposal for the centralisation of so many channels may make their work significantly easier.

No non-trivial corporate will go to the lengths requested without being required to or strong tangible benefits over what they already do and can cost-effectively procure in future. After all, there is nothing in the proposal that corporates cannot already do themselves.

In short, this seems to be at best a security industry playground and the founding companies business model as a play on security concerns subsidised by others, or at worst, security theater.

It would be very interesting to know Bruce Schneier's take on this...

</comment><comment><USER20> Sounds like they would be trying to operate as a sort of Centralised Certficate Authority.

Didn't Verisign try something similar, only to get out of that business as soon as it became obvious the whole system is easily exploited and inherently insecure?

It will be interesting how this company tries to explain how this is different.

</comment><comment><USER21> It's a way for a security firm that does audits, escrow and such for customers -- who all have websites -- to sell more services.

"We sell domain names too!"

Just one more thing they can add to their list of "services".

Does it increase security?

Just throw in some buzzwords that clients identify with security. Sold.

No one ever audits the auditor.

Maybe it increases security in the mind of the client or the end-user.

And that's enough to sell the services.

</comment><comment><USER22> This thing reminds me of the Oracle Unbreakable PR stunt: <http://www.securityfocus.com/news/309>

Sometimes, it even makes me wonder if they choose these kinds of names to get penetration testing services for free.

</comment><comment><USER23> Because all users will know the difference between realbank.secure/index and fakebank.com/index.secure ...

<comment><USER24> This. When it comes to fishing, there is one rule: don't change your TLD. When I log in to PayPal I am always getting redirected from paypal.com to paypal- deutschland.de (the german tld), how is someone who is not internet savvy supposed to know whether he is getting phished or not, when even the companies use different TLDs?

Be consistent - using citibank.com and citibank.secure does not help at all, it will only confuse customers even more.

</comment></comment><comment><USER25> What could possibly go wrong?

</comment><comment><USER26> Ugh. Just get rid of restricted TLDs entirely. Oh wait, ICANN finally decided to do that, but then made it into a giant sham and rip-off.

Inept clowns and scammers.

<comment><USER27> Why would it be a good idea if it was free?

</comment></comment><comment><USER28> If they do a good job and gain enough respect and trust this could be big. I'm not sure it will actually go anywhere but maybe.</comment>


Fastai founders on why everyone should wear a mask - <AUTHOR> https://www.youtube.com/watch?v=BoDwXwZXsDI <comment><USER2> They keep talking about how masks does help and show Taiwan can produce a lot and then show pictures from the US of people with respirators - not masks.

If you don't understand the difference between a mask and a respirator I'm not surprised you misunderstand the surgeon general. Masks is to keep spit and the likes away from others (no it doesn't filter viruses), respirators are for filtering viruses, etc. in both directions (unless it has a valve, then it only filters air in, not out).

Unless you use sterilisation for your masks and respirators they need to be used only for short amount of time and you need to wear gloves when you take it off. If you just use it as most people outside of healthcare does all you are doing is wearing a Corona bomb on your face. Keeping alittle distance is much better and won't cause respirator shortage.

<comment><AUTHOR> I mean half the video is talking about the (proven) effectiveness of homemade cloth masks of various materials vs N95 and surgical masks, so you certainly can't accuse them of not understanding the difference.

You are making quite a strong claim. Do you have any evidence for that? Why would getting some coronavirus on your hands when you take the mask off be worse than inhaling it? Of course many healthcare workers are being issued only one respirator per day, and they are exposed to drastically more coronavirus. It's not exactly difficult to simply wash a cloth mask like any other piece of clothing, and a surgical mask isn't very difficult to sanitize either.

Moreover if you are sick and don't know it a mask protects everyone else from the primary infection route.

</comment></comment><comment><AUTHOR> Seems like a reasonable fit for HN. If you are skeptical look at their collated list of papers on the effectiveness of homemade masks. [https://docs.google.com/document/d/1HLrm0pqBN_5bdyysOeoOBX4p...](https://docs.google.com/document/d/1HLrm0pqBN_5bdyysOeoOBX4pt4oFDBhsC_jpblXpNtQ/preview#heading=h.9yzpxufkt5ow)</comment>


The Mac No Longer Competes Against the PC - <AUTHOR> http://www.macobserver.com/tmo/article/the_mac_no_longer_competes_against_the_pc/ <comment><USER2> this last graphic in this blog post from the always interesting asymco examines this nicely:

[http://www.asymco.com/2012/07/04/the-building-and- dismantlin...](http://www.asymco.com/2012/07/04/the-building-and-dismantling- of-the-windows-advantage/)

quite a stunning change, totally left field. neat.</comment>


Web Application Penetration Testing Cheat Sheet - <AUTHOR> https://jdow.io/blog/2018/03/18/web-application-penetration-testing-methodology/ <comment><USER2> Be sure to let AWS know you are pentesting before you start testing your app hosted there. [https://aws.amazon.com/security/penetration- testing/](https://aws.amazon.com/security/penetration-testing/)

<comment><USER3> Commentary in the spirit of security automation:

 _Of course Amazon still compels a human review._

By contrast, Google App Engine and Microsoft Azure are fine with you doing it on your own provided you're not a moron.

[https://support.google.com/cloud/answer/6262505?hl=en](https://support.google.com/cloud/answer/6262505?hl=en)

[https://docs.microsoft.com/en-us/azure/security/azure- securi...](https://docs.microsoft.com/en-us/azure/security/azure-security-pen- testing)

(I deal with AWS, Azure, and GAE across multiple companies. heh)

</comment></comment><comment><USER4> Can somebody tell me as to what pen testers typically earns?

I once talked to a firm doing pen testing and the figures they paid were the same as any other firm would pay a midlevel developer working in a regular software dept in a corporation in that city.

Assuming pen testing requires a skill level a notch or two above the 'average' developer, I would have normally assumed that ideally they would be paid significantly better.

<comment><USER5> I get the idea that most pen testers are entry-level and spend their time doing standard scanning and looking for standardized types of vulnerabilities using pre-built tools and techniques. The ones who can build those tools and come up with novel attacks against well-protected targets are the top of the heap.

What is probably scary is just how many commercial sites can be compromised by those standard well-known techniques.

<comment><USER6> Equifax Argentina (or was it all south America?) was compromised from the admin password "password".

People are incredibly oblivious to how easy they are to break and how tempting a target they are.

<comment><USER7> 'We used to quip that "password" is the most common password. Now it's "password1." Who said users haven't learned anything about security?' \-- Bruce Schneier

</comment></comment></comment></comment><comment><USER8> One of the tools listed here is DNSDumpster.com.

Can someone explain how the enumeration of subdomains on a hostname works?

I know that zone transfers is one way, but I looked up one of my domains and it includes a private subdomain I've never published anywhere.

I checked and my DNS provider does not allow zone transfers (as far as I can tell) so I'm curious how this information is obtainable.

And I mean through ordinary means, let's ignore the "your account/ISP/Registrar may be compromised" scenarios. Are there everyday scanning tools that allow for this?

<comment><USER9> "The search relies on data from our crawls of the Alexa Top 1 Million sites, Search Engines, Common Crawl, Certificate Transparency, Max Mind, Team Cymru, Shodan and scans.io."

So probably CT logs.

Also, if you've ever sent a cold-cache query to a recursive resolver that didn't employ QNAME minimization (few do), it was likely harvested by pDNS replication at the TLD nameserver level and shared with a number of commercial and research parties' databases to which DNSDumpster may subscribe.

<comment><USER8> This seems like the most likely candidate then (a resolver that caches and shares requests or CT - which I didn't know about), because the subdomain is a random string of characters so it wouldn't have been brute-forced.

Thank you for the insights!

</comment></comment></comment><comment><USER10> Great post. I find the zap tool from OWASP useful for some of this stuff. [https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Proje...](https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project)

</comment><comment><USER11> This looks cool! I have the other perspective -- I have a site that I want secured. This seems helpful for that angle also. I'd be interested if there are other resources as well that could be suggested on this thread!

<comment><USER12> I've done a bit of pen testing and the cheat sheet presented gives very good advice in one place for the basics.

I'd love to see web devs use something like the procedures outlined as a final check before going for sign off. When testing your own stuff, do the heavy scanning stuff "internally". You can always deploy a throwaway Kali Linux box on the same VLAN if its justified.

Now as to your question: Remember that the site itself may not be the actual target. For me, an awful lot of pen testing involves perusing Facebook, Twitter and the like and obviously peruse the site itself as a user. Customer testimonies, web dev links and their site's customer testimonies and proud stories are useful. I always spider for docs and look at metadata in them. Companies House and similar registries (in the UK, other countries may have similar) is handy to help join dots. A little imagination and publicly available information can inform a decent social scam.

My top advice here is pretend to be a baddie and look at your stuff from the outside. Once you discover just how exposed everyone is, then evaluate it and then start the staff/partner/whatever training. If applicable, your telephone reception should have a human firewall on it - mine does. I'm an MD of a small company and I defy anyone to get past them. They take great pride in making calls to me from _ahem_ friends/colleagues/etc not get through but get a request to send an email to sales@<firm>.co.uk and yet I still get the calls I want. When they are uncertain they check with me first. Make it a challenge and part of the culture and deploy honest praise for a good job done. Gatewaying all of your calls via your experts rather than a DDI to all staff is a good idea.

Notice how most of the stuff I've gone into depth about doesn't really involve anything fancy technologically. If I was a real general purpose baddie, I wouldn't be fussed about your user accounts and passwords or even your company secrets. I'd be wanting to make your accounts department send me a few thousand quid to some random account. However, the industry or purpose of your ... system ... will inform your approach to pen testing and securing. I have had to pen test a few schools and I took a rather different approach than I would for a firm of accountants.

There's no right or wrong answer and remember that a web site is not in isolation. People use them.

<comment><USER13> > I'd be wanting to make your accounts department send me a few thousand quid > to some random account.

A few thousand? What's the rationale behind that number?

<comment><USER12> None whatsoever - I was generalising. Incidentally, I should point out that whilst I have a fair idea of the plan of attack: I would be bloody useless at actually carrying it out 8)

</comment></comment></comment></comment><comment><USER14> I was using sqlmap once and was genuinely surprised how good UI it has. It automatically does so much guesswork and only asks highly important questions, but at the same time it never gets in the way. Also, it does few other things beside just SQL injection, and it surprisingly gave me shell access when I was not even looking for it.

</comment><comment><USER15> Nice, just started reading and looking forward to it, but also I'm loving this blog setup, particulary how clean the "warning" sections are. Is it a custom setup?

<comment><USER16> It seems to be the default Jekyll theme: [https://jekyllrb.com/docs/home/](https://jekyllrb.com/docs/home/)

<comment><USER17> Nope, that would be minima: [https://github.com/jekyll/minima](https://github.com/jekyll/minima)

Minima's the theme you get when you run "jekyll new".

This is just a theme that Jekyll uses. I'm not quite sure it even has a name.

</comment></comment></comment><comment><USER18> Are there tools that automatically do all, or most, of this and present the data in a nice GUI?

<comment><USER19> Yes.

People running these tools are so common that "automated reports" are routinely excluded from public bug bounty programs. The ratio of false findings to true findings is very high.

<comment><USER20> > The ratio of false findings to true findings is very high.

Had to deal with one of these canned reports a while back to satisfy some enterprise contract. Had a dozen or so JS "vulns" that were only applicable to a Node environment that were being reported for client-side use. We were not a Node shop. I couldn't believe we'd paid money for that garbage report.

</comment></comment></comment><comment><USER21> It could be just me, but it looks like running that set of automated scanning tools could itself be automated. Press button, pentest done, report sent off. There must be more to the job, what else is involved?

<comment><USER22> Automated tools can only discover so much, because there are always edge cases that tools won't be able to analyze or exploit. Human creativity is a big part of penetration testing, whether it's web application assessments or other types of penetration testing, because tools have false positives, and can't come up with creative bypasses for security measures in the way a human can.

You can definitely automate many parts of testing, especially enumeration steps, but any security professional knows that a tool is no substitute for a knowledgeable hacker.

</comment></comment><comment><USER23> This is really handy. Thanks for posting it.

</comment><comment><USER24> what's with the title? edit: was "Yo" lol

<comment><USER15> Saw that too weird lol</comment></comment>


120,000 W Ytterbium fiber laser commercially available, runs on 480V - <AUTHOR> https://www.ipgphotonics.com/en/products/lasers/high-power-cw-fiber-lasers/1-micron/yls-1-120-kw#%5Byls-up-to-500-kw%5D <comment><USER2> Note that they're talking _watts_ not _joules_. That implies continuous output, or heavy duty-cycle output.

At 480V, that's 250 Amps. That's a very heavy-duty current, and necessitates very heavy conductors to reduce the resistance as much as possible.

Wouldn't it be better to use a higher voltage and allow for the use of a lower current, and not so massive conductors?

<comment><USER3> There are many models and I'm not an expert so I'm not sure which type they are using. But note that the usual number of kilowatts is for the power during the peak. For example from: [https://en.wikipedia.org/wiki/Q-switching#Typical_performanc...](https://en.wikipedia.org/wiki/Q-switching#Typical_performance)

> _Typical performance_

> _A typical Q-switched laser (e.g. a Nd:YAG laser) with a resonator length of > e.g. 10 cm can produce light pulses of several tens of nanoseconds duration. > Even when the average power is well below 1 W, the peak power can be many > kilowatts. Large-scale laser systems can produce Q-switched pulses with > energies of many joules and peak powers in the gigawatt region. On the other > hand, passively Q-switched microchip lasers (with very short resonators) > have generated pulses with durations far below one nanosecond and pulse > repetition rates from hundreds of hertz to several megahertz (MHz)._

</comment></comment><comment><AUTHOR> (Meta: HN wouldn't let me write "120 kW.")

I have no idea if this marketing wank or not, but it seems plausible and investigable with some due-diligence.

<comment><USER3> I think it's a pulsed laser, but I can't find a good sentence to quote in the website. [https://en.wikipedia.org/wiki/Pulsed_laser](https://en.wikipedia.org/wiki/Pulsed_laser)

They are "off" most of the time accumulating energy, and then they send a very high power pulse, so the average power is not so high. The on-off switch is many times per second.

In some applications it is more important the maximal power than the average power.

[About the title: It's probably a false positive in the automatic filter to prevent spam and linkbait, sometimes it's too strict. You can use the "edit" link below the title to fix it. If that fails, you can send an email to the mods firstname.lastname@example.com so they fix it. Anyway, it would be a good idea to send the mail so they fix the automatic filter.]

<comment><USER2> _They are "off" most of the time accumulating energy, and then they send a very high power pulse, so the average power is not so high._

They are talking _kilowatts_ , not _joules_ , so the average power is very high. To get that sort of average power, any pulses must either be quite long or extremely powerful.

<comment><AUTHOR> The datasheet claimed 100% duty cycle CW depending entirely on chilled water capacity. I think the military weaponized one are pulsed in the same average energy range, but have a much higher impulse that causes destruction of targets. So the commercial CW ones can cut a steel plate at a certain rate, but the military pulsed ones would obliterate a target.</comment></comment></comment></comment>


Apple Pulls Shadow Cloud Gaming Service from App Store for Violating Guidelines - <AUTHOR> https://www.macrumors.com/2020/02/27/apple-pulls-shadow-gaming-service-from-app-store/ <comment><USER2> Anti-competitive behavior from apple as usual :(</comment>


Using the Canon Hack Development Kit - <AUTHOR> http://spectrum.ieee.org/geek-life/hands-on/using-the-canon-hack-development-kit/0

<comment><USER2> I couldn't imagine using my old Canon point and shoot (PowerShot A530) without CHDK. If you load it onto an SD Card with a "bootable" partition flag and enable the write-protect tab before you insert it into the camera, CHDK automatically boots up when you power it on (and it still writes to the card just fine)

</comment><comment><USER3> Great timing: I was just wondering how to program a PowerShot to take intermittent shots while mounted on the dashboard of the car (to make a short film of a long road trip).

<comment><USER4> I wanted to do the same thing, but with the camera mounted over a heavily- trafficked underpass.

I never got around to it due to a shortage of time, plus I wasn't sure how long the battery would last, and rigging up a box with a big battery, wires, and a camera in a public place seems like a fun way to spend an evening or seventeen being interrogated by three-letter agencies.

</comment></comment><comment><USER5> Previous discussion on this article: <http://news.ycombinator.com/item?id=1955717>

</comment><comment><USER6> Canon's really come a long way with their software, I remember having to battle a lot of driver issues with their scanners under early versions of OS X.

Their camera platform is a lot more engaging to experimenters, too bad I hooked up with Nikon so early; I can't stand Canon's SLR controls.

<comment><USER7> > Canon's really come a long way with their software

The CHDK wasn't created by Canon. It's a community effort released under the GPL.

<comment><USER6> Consider my comment redacted!</comment></comment></comment>


Video - Change your app design in realtime, from my website. - <AUTHOR> http://www.itheme.com

<comment><USER2> This is a fine idea. I would expand it a bit more to include native UI controls. I wish Apple would figure out a way to allow on the fly code changes without having to push an update. THAT would be nice.

<comment><AUTHOR> Hey Thanks for your comment,

If you have a look a the code, there is a whitelist of controls that you can allow to be edited.

This is just the start really, I think being able to change images/CALayers etc can be added in quite easily.

</comment></comment><comment><USER3> I watched the video and still have no real idea what this is or indeed what it is meant to achieve.

Some written information, even just a general background would be useful.

<comment><AUTHOR> Hi,

I live and work in the UK, my designer friend lives on the other side of the world.

Whenever he has a new design for an app I'm making, he sends me the PSD files, I cut them up, export the images, add them into the app, compile and send him a new version of the app. Rinse & Repeat.

This is a crazy way of working. By allowing my designer friend to login to itheme.com, he can create different layouts of my app and test them in realtime.

I can then look at, and try out the different themes.

Thanks

Chris</comment></comment>


MoMA Recognizes Susan Kare, the Designer of the Macintosh's Original Icons - <AUTHOR> http://www.fastcodesign.com/3043312/moma-recognizes-susan-kare-the-designer-of-the-macintoshs-original-icons <comment><USER2> Kare is surprisingly unknown in the computer community. Everybody in design knows who she is, of course. Not only did she design the Mac icons, she designed some of the original Windows icons, some of the iPhone icons, and some of Facebook's icons. Her artwork has been seen by billions of people.

Her web site is "kare.com". Lots of icons.

<comment><USER3> Not to mention the most played video game of all time: Windows Solitare.

[http://m.fastcompany.com/1671462/a-real-deck-of-cards- that-i...](http://m.fastcompany.com/1671462/a-real-deck-of-cards-that- immortalizes-windows-30-solitaire)</comment></comment>


12-inch MacBook Review - <AUTHOR> http://www.theverge.com/2015/4/9/8372335/12-inch-macbook-review

<comment><USER2> "You are really, really going to want this laptop". Really? Don't tell me what I want. This reads like a breathless child is getting a new present. And they just learnt the word 'impossible'.

</comment><comment><USER3> Arstechnica.com review: [https://news.ycombinator.com/item?id=9348815](https://news.ycombinator.com/item?id=9348815)

</comment><comment><USER4> _You can't crank it up to the full resolution, but you wouldn't want to anyway_

There's software for that, and you can bet your bottom dollar I'll be doing it ;-)

</comment><comment><USER5> Love the size but just not enough power yet.

</comment><comment><USER6> This reads like an advertisement. Why is it on the front page of HN? I call BS.

This is not the "Platonic ideal of a laptop"—it's a smartphone with no touchscreen and no modem.

<comment><USER7> I agree, it struck me as breathless and fact-free. I gave up reading when I could not find any review, just description and praise, praise, praise.</comment></comment>


Ask HN: What's the best contact management solution for hustler founders? - <AUTHOR>

When you leave an event with 10, 20 or 50 business cards what do you do with them?  What platforms or apps work best for the busy hustler? <comment><USER2> Are you looking for something different than a CRM? Typically people will scan the business cards they get from a tradeshow with something like Worldcard and import the CSV into whatever CRM their organization uses.

<comment><AUTHOR> For all intents and purposes I suppose I'm looking for a minimalist CRM. By virtue of being extremely early-stage (looking for co-founders and investors) the simpler and cleaner the interface the more it will suit my needs. Perhaps I could roll my own SugarCRM with 95% of features turned off, but I think there has got to be a turn-key web app that fits the bill out there somewhere.

</comment></comment><comment><USER3> I'm a big fan of Streak if your primary communication tool is email.

</comment><comment><USER4> Pipedrive. By a country mile. Lightweight CRM + contact management. And they have a sweet iOS app.

<comment><USER5> Thanks very much for the suggestion! I just signed up and it's exactly what I wanted. Going to see how the free trial goes but so far it looks great. Very intuitive interface.

</comment></comment><comment><USER6> "hustler founders" - every piece of shit which PG says is picked up and abused

<comment><AUTHOR> This is interesting. Would you mind clarifying what you mean by this point?

<comment><USER7> Herp. You just reinforced his point.

</comment></comment></comment><comment><USER8> carddrop.com (currently in beta but I can get you an invite) [disclaimer: I'm the co-founder]

<comment><AUTHOR> Looks like a really cool app but currently the problem I'm trying to solve is the inverse: what do I do with clumps of contacts (new people I meet) I am trying to sort and manage day to day?

Example of one potential (but unvetted) solution: <http://www.contactme.com/>

I was wondering if anyone has personal experience with a particular app or platform that works well for them.

<comment><USER8> Oh I see... well right now our focus is in sharing contacts easily and keeping the parties connected. We do provide an organizer that is powered by search, ex: "PHP developer" will find contacts that has PHP development skill-set. What's interesting is you may have never known that person is a PHP developer until now.</comment></comment></comment>


The Impossible Chessboard Puzzle - <AUTHOR> https://www.youtube.com/watch?v=wTJI_WuZSwE <comment><USER2> It's a nice puzzle, and when I first saw it several years ago I was pleased to solve it. I then performed it live as my 5-minute talk at one of the Annual MathsJam Gatherings, I think in 2015, so I probably solved it in early 2015.

It's been around a lot longer than that - it was on Reddit in 2013, and I'm sure it's older.

 _Edit:_ Here's a reference from 2010:

[https://eucalculia.blogspot.com/2010/10/prisoners-and- chessb...](https://eucalculia.blogspot.com/2010/10/prisoners-and-chessboard- solution.html)

Now found in a January 2009 maths journal:

[https://web.northeastern.edu/seigen/11Magic/Articles/Two%20A...](https://web.northeastern.edu/seigen/11Magic/Articles/Two%20Applications%20of%20a%20Hamming%20Code.pdf)

The College Mathematics Journal Contents—January 2009 Vol. 40, No. 1, pp. 2-76</comment>


Google Drive as video CDN - <AUTHOR> http://getvideodrive.com/ <comment><USER2> That site won't load unless you turn off adblocker.</comment>


Why don't founders validate properly? Or, why didn't *you* validate properly - <AUTHOR> I'm interested in what stops people skipping this vital step, especially when "no market need" is often cited as the top reason for startup failure. Surely validation mitigates a huge amount of this risk, so why do startups avoid it so often? <comment><USER2> There are a couple of reasons:

\- It's uncomfortable. You are typically so excited about an idea that the thought of learning it doesn't have mass appeal is uncomfortable. People avoid uncomfortable realities. In other words: "I KNOW this is a great idea, I just KNOW it. If I don't build this NOW, someone else will beat me to it. I don't have time to waste talking to customers. If Henry Ford would've asked people what they wanted, they would've said a faster horse."

\- People are proud, if they're going to show a product to their friends/family, they want to make sure it's well-built, fully featured, etc... The idea of "just getting something in front of customers that works" aka an MVP is embarrassing for some people. They think that if they release a "amateur" product, people will think they're amateur.

\- People are irrational. They think that their idea is so special that asking people about it, getting validation, etc... could make them a target for idea theft. So they isolate themselves, validate with a few close friends (who are unlikely to give honest, brutal feedback) and build a huge product so that when they launch, they'll be far ahead of their competitors. The problem with this is that you'll likely build the wrong product the first time around.

<comment><USER3> These are spot on - having fallen victim to all three.

I'll add that, for the tech minded, building is easy in comparison to validating. Just fire up the IDE, write code, and debug. Validating involves putting your idea (and by association, yourself) out there for the world to potentially ridicule... and then trying to convince people to open up their wallets to your idea. Not so easy.

</comment></comment><comment><USER4> because I can't find enough potential customers in my direct network. reaching out to strangers is also difficult without trust. the cold email response rate is 2%. For example, I built a new blogging platform ([https://epiphany.pub](https://epiphany.pub)), I couldn't find many bloggers in my direct network. I start a project to fulfill my needs, but I don't know where to find enough other mes.

also it is a chicken-egg dilemma. It's hard to validate without a prototype. (I know the dropbox story, it won't work in all cases.) sometimes, a product is trying to improve user experience, not about an innovative idea. I think that user experience has to be felt.

I also feel that customer interviews might be misleading sometimes. I remember when iphone was launched first time, it was way pricier than other cell phones. A lot of people were nay sayers including myself.

<comment><AUTHOR> I think customer interviews are definitely part of the mix, if done right (have you read The Mom Test?), but they don't give you 100% clarity. Perhaps just a more solid hypothesis...

</comment></comment><comment><USER5> I would argue that "no market need" is not one of the biggest reasons why startups/companies fail. Most startups fail because they fail to execute specifically within their market and/or find their product/market fit. So in other words, market is definitely there but there is failure in execution and inability to capture a decent market share. They try to sell to everyone which basically becomes you sell to no one (unless you are Amazon but that takes 20+ years of capital to survive and is outlier)

<comment><AUTHOR> I suppose you can speak about it in a few different ways. Whether that's Product Market Fit, or No Market Need. I was going on this research - [https://www.forbes.com/sites/deniselyohn/2019/05/01/why- star...](https://www.forbes.com/sites/deniselyohn/2019/05/01/why-start-ups- fail/#65bae51d28a5)

</comment></comment><comment><USER6> validation is noisy, and can be just as hard as building the the thing.

If you put up a landing page and people immediately start buying, great. What happens if you get no conversions? Is it the product, market, your marketing? How much effort/money do you put in before you say it's a negative result?

marketing is an adverse learning environment, and beginners typically misattribute the cause of failure. It's difficult to learn incrementally via trial and error, unlike coding.

the best way to mitigate "no market need" is to solve an existing pain (that the market is already buying) rather than inventing new ones.

</comment><comment><USER7> I think there may be an overallocation of failure reasons to "no market need". If the founder started working on something to solve a problem of their own have seen at least a few other users use the product successfully but are not getting enough traction, there's a bunch of stuff to figure out, but success may be a long way off.

</comment><comment><USER8> Time, perhaps? You can find a handful of customers to "validate" a product relatively easily (at least enough to justify it in an early Powerpoint deck.) This doesn't mean there's enough customer demand for a real business.

<comment><AUTHOR> So you think it might be a resource thing? If they had more time/money/runway they would possibly do a better job?

Agreed that it's easy to think you've validated by getting a handful of people to nod enthusiastically at a Powerpoint!

<comment><USER8> Yes, resource constraints, and overly optimistic, often delusional, thinking. (The idea is so great, it doesn't need validation... etc.)

</comment></comment></comment><comment><USER9> Are there any products from "successful " startups that were fully validated before being developed/taken to market? Focusing too much on validation can swap risk of not having market fit with the risk of being late to market. You are not the only one working on an idea.</comment>


iPhone audio detectable with AM radio - <AUTHOR> https://twitter.com/doctorcube/status/1300953606221422594 <comment><USER2> It's probably by design, iPhones support magnetic-induction hearing aids, see here:

[https://support.apple.com/en-us/HT202186](https://support.apple.com/en- us/HT202186)

The are 2 standards, the old "telecoil" (direct) and the new FM loop, both operating at low frequencies...

Both work at very short ranges (inverse cube of the distance)

<comment><USER3> Excellent that there is accessibility support, but at what range can people pick my calls up – especially with a directional antenna?

<comment><USER2> Approximately the same distance as a good microphone can pick up the audio anyway. Read about near-field vs far-field:

[https://en.wikipedia.org/wiki/Near_and_far_field](https://en.wikipedia.org/wiki/Near_and_far_field)

</comment></comment></comment><comment><USER4> I've found that the iPhone display is quite easily detectable between 400nm and 700nm wavelengths.

<comment><USER5> That sounds way worse since it's in the frequency range of many high-powered lasers.

It's also in the range of many low-power lasers, but I'm not worried about them.

<comment><USER6> Woosh...

</comment></comment></comment><comment><USER7> Most likely not an FCC (EMC) issue. This sounds like direct inductive coupling from speaker D class amplifier output (or power, which would be worse, but not likely) circuit at <100 kHz. Below 30 MHz only conducted emissions are measured (common mode emission via cable, say, forming a large antenna together with the power grid). The emitting component may be the speaker or (unshielded) output filter (for EMC compliance!) of the amplifier.

Why it is not an issue, is that magnetic field decays really rapidly, (inversely proportional to the cube of the distance [1]) and thus is not a general concern. In fact some "secure by physics" nearby communication methods like RuBee [2] relay on this.

[1] [https://en.wikipedia.org/wiki/Near_and_far_field](https://en.wikipedia.org/wiki/Near_and_far_field)

[2] [https://en.wikipedia.org/wiki/RuBee](https://en.wikipedia.org/wiki/RuBee)

<comment> 0-_-0 A later tweet says "I was able to hear it from 20 feet."

<comment><USER8> I can hear the iPhone's speaker from 20 feet away, too - without using AM radio technology to do so. (It's a curse, trust me.)

</comment></comment></comment><comment><USER9> Also happens in the reverse. growing up in the shadow of WTOP[1] towers in the DC area, we used to hear WTOP in our rotary phones (between dials mostly) and even sometimes picked up in our ovens (yes, could hear the radio coming out of the oven)

[1] [https://en.wikipedia.org/wiki/WFED](https://en.wikipedia.org/wiki/WFED)

it was really powerful, heck, I even remember in my youth going up to relatives in boston and being able to pick up the signal at night to listen to Oriole games in the summer.

</comment><comment><USER10> This is not surprising. We've been using AM and FM radios to debug circuits for decades. They can pick up oscillations and instabilities.

But the range is centimetres at best. So much so the antenna gets used as a fairly directional probe.

<comment><USER11> In a later tweet he says the signal is pretty strong and that he could detect it from 6 feet away

<comment><USER12> Going to have to call bullshit on this. If it was detectable at that range then he has a faulty phone. The iPhone is classified as an emitter and so it needs to undergo rather strict FCC testing to ensure that it does not emit outside of certain frequencies and at specific power levels. The device would NEVER have been approved if it emitted at this level into bands licensed to other uses.

<comment><USER13> 6 meters is near field in that frequency range. The emission power is possibly well below FCC limits.

</comment></comment></comment></comment><comment><USER14> My neighbor is a Ham radio operator (don't remember which frequencies are used in Germany). I sometimes can pick up the incoming radio signal. He explained to me it's most likely the amp de-modulating the signal that is fed into the power line and my headphone cable acting as an antenna. When I first heard voices speaking I was a little freaked out for a moment I have to admit.

<comment><USER15> I remember picking up the conversation coming from a hot air balloon one day I was playing on the computer. I was focused on the game, and suddenly these voices start overlapping with the sounds I'm used. Today I'm not even sure it was possible. The speakers were that kind that made a noise when receiving or sending an SMS from a nearby mobile phone.

</comment></comment><comment><USER16> I'm surprised this wasn't discovered sooner. For a while, when I was working in Portland radio, there was an AM station that played recent indie releases on it. Needless to say, while it was the butt of countless hipster jokes, there was a sizable crop of people with both AM radios and iPhones on them, frequently operating at the same time.

<comment><USER12> It wasn't discovered because either it didn't happen or the person claiming such has a faulty device. The FCC would never allow these phones to be imported for sale if they were so sloppy in their emissions. The idea that there are millions of people out there listening to AM radio every day for hours at a time in cars and homes/offices in close proximity to iPhones but no one ever detected this before is laughable.

<comment><USER17> Arguments by appeals to authorities like the FCC, CDC, or FAA sort of work if the authority can be trusted.

For the argument to be coherent that trust must have been established by a proven track record of both employing the appropriate methods correctly _and_ showing independence of vested interests in their reporting of the results.

<comment><USER12> Apparently you have no idea what you are talking about, so you think that these sorts of arguments work when discussing FCC emission testing. The FCC does not actually run the test, they set the standards. The tests themselves are run by various labs and testing agencies that are certified to perform the tests and who would be risking a very lucrative gig for the sake of cheating on a test for a device that will be widely deployed and certainly tested by third-parties who will want to examine the device. It is possible for some mid-range device to slip through or bribe someone to pass a test, but unlikely to the point of absurdity that this would be done for something like an iPhone.

<comment><USER17> Hilariously, this is what I found when searching for the public test results of the iphone8, apologies for it being about a previous generation, but happily your argument is insensitive to such details: [https://www.chicagotribune.com/investigations/ct-cell- phone-...](https://www.chicagotribune.com/investigations/ct-cell-phone- radiation-testing-20190821-72qgu4nzlfda5kyuhteiieh4da-story.html)

The summary of the above article is that yes: _if_ you hold the phone sufficiently far away from the measuring device the detected radiation is below the levels mandated, and if someone else tries to test the emission for themselves Apple will say they did it wrong and refuse to give any explanation of what the error might be. A bullet proof system indeed.

<comment><USER12> Lol, 2mm. That is the distance this test used that you claim is some sort of support for your argument in this case. Sorry, but the only other corroborating evidence is a later claim made by a company that sells RF- shielded phone cases. I am going to have to chalk this one up to unclear guidelines (mis)interpreted by people who do not understand the square power law.

Try again.

<comment><USER18> I feel like you may have very good points to contribute, but your dismissive and combative tone is kinda ruining it for me.

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> Meh. More fun is listening to the GPU redraw the screen and the cpu servicing interupts, both of which you can hear by holding an AM radio close to the phone.

<comment><USER20> For most laptops you don't even need a radio, just ears.

<comment><USER21> I can't wait for laptops to start including the 30xx series NVidia cards in it and replace mine, because my current one is so awfully noisy. The sound of the USB circuitry in my laptop processing my mouse movements is louder than the sound of my mouse moving across the mouse pad, and when I'm moving a bunch of data around the SSD in my laptop makes as much noise as the physical hard disk it replaced! I am constantly in awe of how noisy some things that aren't supposed to be physically moving at all can be.

</comment></comment></comment><comment><USER22> I just tested this on my iPhone XS with both an old AM radio and my SDR receiver, and neither seemed to cause any kind of signal or interference around the 930-980 KHz range.

My dad, a radio engineer (who worked for one of the US' largest AM radio stations for a decade), also tested with his XR and couldn't find any signal. I'm wondering if either it is limited to the iPhone 7 and/or 8, or if the Twitter OP might have a faulty unit?

Has anyone else been able to replicate the result?

<comment><USER8> Retest with the hearing aid settings enabled?

[https://news.ycombinator.com/item?id=24363153](https://news.ycombinator.com/item?id=24363153)

 _To activate Hearing Aid Compatibility on an iPhone with iOS 13 or later, go to Settings > Accessibility > Hearing Devices. On these iPhone models, Hearing Aid Compatibility modifies the phone's acoustic settings to improve compatibility with hearing aids set in "T" or telecoil mode._

 _If you have an iPhone 6 or earlier, you can activate Hearing Aid Mode. To activate Hearing Aid Mode, go to Settings > General > Accessibility. Hearing Aid Mode reduces the transmission power of the cellular radio in the GSM 1900 MHz band, which may result in decreased 2G cellular coverage._

</comment></comment><comment><USER23> Isn't it more or less how inductive speakers[0] work?

[0]: [https://youtube.com/watch?v=vDrRNdgz2C8](https://youtube.com/watch?v=vDrRNdgz2C8)

</comment><comment><USER24> Pretty interesting.. many class D audio amps drive at frequencies above 100-200khz, so either the odd or even harmonics of that frequency sounds like where you would get the actual audio content showing up in the audible band (not sure if it's odd or even that would be the right one). I want to try this on some other class D speakers.

</comment><comment><USER25> Wow. I wonder how far from the phone this signal could be detected.

<comment><USER26> Just a few meters, as per the article. I'm guessing if you can't hear it on the iPhone's speaker, it won't be audible on AM radio either.

<comment><USER10> Correct. Although it's possible on older handsets with 3.5 jack that the audio amplifier in the handset itself is possible to receive. I'm not sure about lightning.

But I very much doubt at the stated range. The EMC guys would be all over that.

</comment></comment></comment><comment><USER27> This feature was also available on the Altair 8800. [http://vintagecomputer.net/browse_thread.cfm?id=720](http://vintagecomputer.net/browse_thread.cfm?id=720)

</comment><comment><USER28> Why does it say it's an FCC problem? What are the consequences that Apple may face?

<comment><USER29> Wirelessly transmitting devices have a lot of regulations on what they can transmit, they need to be certified by the FCC, and are not allowed to transmit in certain frequency bands beyond a certain power.

Some of the discussion here is asserting that this is just induction (i.e. a changing magnetic field causing a changing electric field in the radio, rather than the radio antenna picking up the signal). if that's the case, I'm unsure about why the radio would need to be set to a specific frequency to pick this up (is the proposed inductance in the speaker wire?). Magnetic fields drop off very quickly (with the inverse square of distance) so this is also why people are saying this would be a very short range effect.

The other options seem to be a faulty device actually emitting electromagnetic waves in the stated frequency domain, or an actual fault in general with iphones emitting at that frequency.

The last one would likely have very large consequences for apple (i.e. iphones not able to be sold in the US, and then probably most other markets with similar regulations, i.e. anywhere). Companies tend to be pretty strict on the testing of these things due to the large repercussions, which is why I assume people think it's unlikely.

What I don't know is the repercussions for apple producing some faulty devices that would broadcast EM radiation like that, can anyone fill me in on that?

</comment></comment><comment><USER30> I can do this with my Asus laptop as well, at up to about 5 meters distance.</comment>


Literary Machines (1987) [pdf] - <AUTHOR> https://monoskop.org/images/b/be/Nelson_Ted_Literary_Machines_c1987_chs_0-1.pdf <comment><USER2> Thanks for sharing.

Ted is a great thinker for sure but not so good at realising his ideas. He had envisaged a tool for documenting his own multi-dimensional thinking / writing and therefore would not compromise or build something simpler for everyone. Like many unfinished projects complexity and the desire for perfection was the downfall of project Xanadu. I think Roger Gregory [1] deserves some kudos for trying to implement these ideas.

[1] [https://en.wikipedia.org/wiki/Roger_Gregory_(programmer)](https://en.wikipedia.org/wiki/Roger_Gregory_\(programmer\))

Tim Berners-Lee will be remembered as the man that successfully implemented the first hypertext system in 1989. I do not think Ted ever got over this. Ted however will be remembered for his ideas.

</comment><comment><USER3> >The strange thing is that all this took so long and then happened so suddenly.

[https://www.businessinsider.com/scientists-reveal-the- tippin...](https://www.businessinsider.com/scientists-reveal-the-tipping- point-for-ideas-is-when-theres-a-10-consensus-2011-7?r=US&IR=T) 'Scientists Reveal The "Tipping Point" For Ideas Is When There's A 10% Consensus'</comment>


FBI forces Apple iPhone X owner to unlock device through Face ID - <AUTHOR> https://www.zdnet.com/article/fbi-forces-apple-iphone-x-owner-to-unlock-device-through-face-id/ <comment><USER2> > _While law enforcement in the US can force a suspect to unlock their Apple > device via Touch ID, this is believed to be the first recorded incident in > which law enforcement in any country has used a search warrant to force a > mobile device owner to bypass the facial recognition technology_

So–at the very least–no less secure than Touch ID.

<comment><USER3> TouchID and FaceID where never about security in the first place. They're about convenience. Nothing more.

You want security, turn off the convenience features, set a pass phrase and plead the 5th.

FaceID and TouchID is like me writing my house address on my keys and then losing them while thinking "oh well, the house is locked".

<comment><USER2> TouchID and FaceID are like setting the door to auto-lock when you leave your apartment. Sure, setting the second lock is more secure. But most people won't bother with that. Because for most people, it isn't worth the bother _ex ante_. TouchID and FaceID have enabled broad-population security practices in a way preaching passwords-only never could have.</comment></comment></comment>


John Paton to News Industry: "Learn One New (tech) Thing" - <AUTHOR> http://jxpaton.wordpress.com/2010/03/07/learn-one-new-thing/

<comment><USER2> Hey man, welcome to the mid to late 1990's.

And if you're just figuring this out now you don't have much business giving advice to the News Industry.</comment>


After a second stage failure, Rocket Lab loses seven satellites - <AUTHOR> https://arstechnica.com/science/2020/07/on-its-13th-launch-rocket-lab-loses-a-mission/ <comment><USER2> HN discussion here: [https://news.ycombinator.com/item?id=23735205](https://news.ycombinator.com/item?id=23735205)</comment>


Show HN: Order Like a Malaysian - <AUTHOR> https://nazroll.com/orderlikemalaysian.html <comment><AUTHOR> An automated guide to help you order drinks in Malaysia. It can work in Singapore & Brunei too.

</comment><comment><USER2> Wah, good job for making something. Ini utk org luar nak bercakap malay ke?

<comment><AUTHOR> yes. betul! hehe</comment></comment>


Plotinus – A searchable command palette in every modern GTK+ application - <AUTHOR> https://github.com/p-e-w/plotinus <comment><USER2> I've always pictured the opposite—rather than taking a GUI and bolting on "fake" command-line like features, why not have a base-class for GUI "main" windows that's essentially already a true, fully-featured terminal emulator showing the stdin/stdout of the executing process?

Then, as you would add graphical controls to the main window in the layout builder, the terminal-emulator-interface part of the window would get squished down further until it just looks like a status-bar. (Which is essentially what status bars _are_ : a very underpowered terminal-emulator only capable of showing the last line of stdout.)

But click [or tab into, or Ctrl-` to activate] the thing, and it'd "pop down", adding more height to the window, if there's room; or "pop up", resizing the rest of the window narrower; or just overlay translucently on top, like in games with consoles.

Opening this wouldn't give you a login shell, exactly—it'd be the stdin of the program. But the toolkit would hook the stdin and turn it into a REPL, based on the CORBA/DCOM/DBUS service-objects available in the program; and the GUI toolkit would then enhance this REPL, by introspecting these service-objects, to enable both textual autocomplete/auto-validate of commands, and the drawing of these sorts of graphical command-palettes. (But you'd be able to "shell out" to process these objects with commands, like you could in scripting languages.)

Or, to put that another way: Plan9's Acme editor is a cool idea, making the whole editor into interface where you can just write magic runes on the walls and then activate them. But there's no real _understanding_ or _support_ for those runes, because they're fundamentally opaque Plan9 executable binaries. What would this look like if we translated it into the object-oriented world that GUIs live in? What would Smalltalk's Acme be like? And then, what if all applications in the OS were built on top of it, the way that you can build applications as major modes in Emacs or as plugins in Blender?

Or, to put than _another_ other way: if Automator in macOS can _already_ latch onto a running program's service API and tell it to do things as a batch script, why can't I _interactively_ access the same APIs from _inside_ the running program itself, as an automatic benefit of using whatever technologies power Automator? Why can't I do the equivalent of opening the Smalltalk Inspector on my GUI program?

<comment><USER3> What you think would've been great, but the entire gtk ecosystem has been wrecked by fallout from Gnome 3.0, and following demise of the community.

Open source projects like GNOME paid a heavy price for not being able to deal with people like Lennart resolutely.

I see it as a great unjustice that 2-3-4 drama queen personas can hound hound out 50+ most productive developers out of the ecosystem, and not the other way around.

This is how Gnome 3.0 was a private project of a few drama queen personas who hijacked an open source project from 100+ people

</comment></comment><comment><USER4> For macOS users - if you haven't known before, a similar functionality is built-in to macOS (Props to Apple for this!).

Cmd-Shift-/ (a.k.a Cmd-?) opens the help menu item, where you can just type in and it filters all of the menu items matching the query. One can press return to execute the item, or discover new shortcuts to items.

</comment><comment><USER5> Awesome. This is something I like about MacOS, and a feature that that Unity had before Canonical switched to Gnome, that I wish was adopted by more desktop environments.

</comment><comment><USER6> Looks quite interesting!

Kudos for using Vala, it needs a bit more love, instead of slowing down GNOME with GJS everywhere.

</comment><comment><AUTHOR> It is available in Arch. I got it to compile on Ubuntu without much hassle. On Nix, it is available but install conflicted with another package. Didn't look into it further.

Keybind is already in use for some Gtk+ applications (Firefox IIRC), and it also makes it painful how some apps I use are not Gtk+ but say Qt... which makes me wonder if there's a thing like this for Qt?

<comment> yjftsjthsd-h > On Nix, it is available but install conflicted with another package

Huh. I was sort of under the impression that nix was supposed to make that impossible.

<comment><AUTHOR> I suppose improbable rather than impossible.

Here is the error:

      error: The unique option `environment.variables.XDG_DATA_DIRS' is defined multiple times, in:
      - /nix/var/nix/profiles/per-user/root/channels/nixos/nixos/modules/programs/plotinus.nix
      - /nix/var/nix/profiles/per-user/root/channels/nixos/nixos/modules/config/shells-environment.nix.
      (use '--show-trace' to show detailed location information)

</comment></comment></comment><comment><USER7> This is just awesome. To my regret many GTK application don't care much about keyboard shortcuts any more. That's why I personally often use terminal applications. This project could actually make many applications usable again.

</comment><comment><USER8> Last commit: two years ago..

<comment> oneshot-a4yukdk It's because gtk+ 4 will no longer support general-purpose loadable modules – the very feature which makes the palette possible. Also the maintainer is disappointed with the attitude of GNOME to third party developers: [https://github.com/p-e-w/argos/issues/75#issuecomment-475844...](https://github.com/p-e-w/argos/issues/75#issuecomment-475844513)

<comment><USER9> Man this is terrible! I was warmed to Gnome 3 (I like the experience unlike most of the loud crowd) but this is inexcusable. Literally a breaking experience for hundreds of third part applications for some reason I just don't understand.

</comment></comment></comment><comment><USER10> This looks useful although I feel like it needs a better default shortcut. Ctrl-Shift-P is emacsish in its contortions.

<comment><USER11> Ctrl-Shift-P is also the command palette in vscode

<comment><AUTHOR> And Sublime Text, Fman, Atom, ...

</comment></comment></comment><comment><USER12> Great! Will this enable creation of a useful voice interface?

<comment><USER13> It does look like a good first step towards that. If I ever find that one service I used that one time to build context-aware intent recognition, I'll definitely try that.

</comment></comment><comment><USER9> Seems dead, last commit was in 2017.

</comment><comment><USER14> Nice! I love GUI projects.</comment>


Ask HN: What front end framework should I choose with Rails and Vue.js? - <AUTHOR> I am currently starting a personal project with Rails 5.1 which I would like to release it in a couple of months and see if I can grow it.
I already decided to use Vue.js as the main FE framework.
(the reason for both of them is that I know them - rails for a couple of years, vuejs I am still learning but I can do basic stuff).
Currently I'm facing a decision as I dont want to create my own CSS framework:
1) Should I use Bootstrap v4 - alpha with Bootstrap Vue (https://bootstrap-vue.github.io) Reasons: easy to find help with Bootstrap and probably a library which will last?
2) Should I just use http://vuetifyjs.com? Is it ready for being use in production?
3) Should I use a combination of Bootstrap v4 CSS styles + http://element.eleme.io for the Javascript elements?
The frontend part will be a mix of Turbolinks/Rails and Vuejs and not an independent Vuejs app. <comment><USER2> Honestly couldn't tell you which is better, but with my current vuejs project I'm using nuxtjs and bulma.</comment>


Python vs. Perl vs. Java vs. C++ Runtimes - <AUTHOR> http://furryland.org/~mikec/bench/

<comment><USER2> Hmm it's a bit rusty: page is from 2001 last update 2002 I think I didn't even know python existed at that time</comment>


Iran Sanctions: People Are Turning to Bitcoin to Get Money Out - <AUTHOR> https://www.forbes.com/sites/billybambrough/2018/04/23/bitcoin-price-bitcoins-up-10-in-7-days-is-the-bull-run-back/ <comment><USER2> Interesting chart I saw shows a big spike in localbitcoin use in iran

[https://coin.dance/volume/localbitcoins/IRR](https://coin.dance/volume/localbitcoins/IRR)</comment>


Diving back into coreboot development - <AUTHOR> https://puri.sm/posts/diving-back-into-coreboot-development/ <comment><AUTHOR> There have been a few discussions on HN recently about good laptops for Linux. I found Purism while searching around myself, although I didn't see any mention of them in previous threads related to Linux laptops. Can anyone comment on them?</comment>


The Male Anglerfish's Evolutionary Solution to Female Rejection - <AUTHOR> https://www.nytimes.com/2020/07/30/science/anglerfish-immune-rejection.html <comment><AUTHOR> >The immunogenetics of sexual parasitism

[https://science.sciencemag.org/content/early/2020/07/29/scie...](https://science.sciencemag.org/content/early/2020/07/29/science.aaz9445)</comment>


Ask HN: Most effective way to learn a new language (not the programming kind)? - <AUTHOR> <comment><USER2> Honestly the only way that things stuck with me was when I was forced to use the language (i.e. immersion).

Previously I persuaded my wife to only speak to me in her native language every Thursday afternoon/evening. That helped a little, but only when I moved and was surrounded by the new language did I really get better.

It took me months to learn to hear AND pronounce the difference between "o" and "ö", and still I get it wrong at times.

</comment><comment><USER3> I'm also curious about this. To my knowledge I managed to learn a good amount of Japanese by literally studying every day for 1-2 hours, listen to a good amount of Japanese music. Rented Japanese books to see if I could recognize any symbols and try to figure out what the book was about. I hope this helps.

<comment><USER4> How many hours did it take for the approach to work?

<comment><USER3> I committed to this for 6 months. Also I studied around the same time every day. What also helped me was that on the course of the day I would force myself to count in Japanese and to try to think in Japanese. Sometimes I would be so distracted that I would catch myself actually thinking in Japanese for a good amount of time.

<comment><USER5> How far would you say you got at the end of 6 months? I took a Japanese 101 class a couple years ago and still remember some basic phrases/verbs/etc and how to read katakana and hiragana as well as probably 50 or so kanji. Been thinking about getting back into it so that I can at least use it at some semi-basic conversational level for my trip.

<comment><USER3> I would say that I got to the point that I was able to understand the majority of the words on Japanese songs and movies. The reading part on the other hand was another story. Talking I was at a elementary level. I was able to defend myself somewhat.

</comment></comment></comment></comment></comment><comment><USER6> As stevekemp mentions immersion is a surefire method.

When learning Indonesian my sole company for most of the day was my korean flatmate, who had no english. We evolved through some hilarious pidgins to fluency pretty fast.

Necessity is the mother of invention</comment>


Show HN: Writing React like Vue 3 - <AUTHOR> https://medium.com/@kutlugsahin/writing-react-like-vue-3-8530356bc5c5 <comment><AUTHOR> Hey folks, I have been experimenting with a way of defining components in React inspired by the Vue 3 upcoming composition api. Feedbacks much appreciated! [https://medium.com/@kutlugsahin/writing-react-like- vue-3-853...](https://medium.com/@kutlugsahin/writing-react-like- vue-3-8530356bc5c5)</comment>


Ask HN: Resources for someone who wants to learn electronics? - <AUTHOR>

I'm interested in learning electronics, but don't know where to start. I know some basic principles and a little bit of electronics knowledge from when I was in school, but beyond that I don't know a whole lot.
I'm a programmer for my job, so I can deal with that side of stuff, but would love to be able to have a hardware side to my projects and be able to use my programming skills to interact with stuff I make.
So HN, any ideas?
Edit: To clarify, I'd like to begin with simple circuits, getting to know the components and such. Eventually I'd like to move on to work with Arduinos and the Raspberry Pi. <comment><USER2> [http://www.lulu.com/shop/brian-evans/arduino-programming- not...](http://www.lulu.com/shop/brian-evans/arduino-programming- notebook/ebook/product-18598708.html)

[http://playground.arduino.cc/Main/ManualsAndCurriculum](http://playground.arduino.cc/Main/ManualsAndCurriculum)

[http://www.neuroproductions.be/logic- lab/](http://www.neuroproductions.be/logic-lab/)

[http://shop.evilmadscientist.com/directory](http://shop.evilmadscientist.com/directory)

[http://www.seeedstudio.com/depot/](http://www.seeedstudio.com/depot/)

[http://forefront.io/a/beginners-guide-to- arduino](http://forefront.io/a/beginners-guide-to-arduino)

[http://www.learnerstv.com/Free-Engineering-video-lecture- cou...](http://www.learnerstv.com/Free-Engineering-video-lecture-courses.htm)

[http://www.electronics-tutorials.ws/](http://www.electronics-tutorials.ws/)

[http://www.ibiblio.org/kuphaldt/socratic/](http://www.ibiblio.org/kuphaldt/socratic/)

[https://upverter.com/](https://upverter.com/)

[http://www.afrotechmods.com/tutorials/](http://www.afrotechmods.com/tutorials/)

[http://www.eevblog.com/wiki/index.php?title=Main_Page](http://www.eevblog.com/wiki/index.php?title=Main_Page)

[https://www.circuitlab.com/](https://www.circuitlab.com/)

[http://jacquesricher.com/NEETS/](http://jacquesricher.com/NEETS/)

get yourself a nice soldering iron and read read read

<comment><AUTHOR> Wow, that's quite a list! Thank you very much!

</comment></comment><comment><USER3> Some excellent advice has been posted already.

to simplify, I would first concentrate on Ohm's law & Kirchoff's laws.

explore the properties & differences between AC & DC.

start becoming very acquainted with schematic drawings, especially the variation that is found among different schools, localities, decades, and plain drawings vs. interactive software schematics. Handle the schematics and spend time studying them. You need to learn the conventions among different industries, especially the way they handle Ground and whether or not all the wiring is even shown on the drawing. Ground is one of the things that is most often assumed to be wired symbolically, which can greatly reduce the drawing's clutter, but you need to be sure you know how to interpret these traditional shortcuts.

Start practically focusing on the difference between a schematic, wiring diagram, assembly drawing, and repair documentation.

start learning about electronic components themselves, you need to recognize what you see on circuit boards, how to cross-reference devices among manufacturers, and understand technical specifications of each part which will end up contributing to the overall performance specification of a complete circuit assembly. Handle the components and spend time studying them. You need to understand the markings & color codes, plus tips & tricks for each type of component. Experiment with them. to the maximum extent possible.

Think about how much you want to be able to assemble circuits (or prototypes) yourself, and what kind of circuits you might want to experiment with most. If you are going to have significant interest in traditional through-hole components, then you will benefit quite a bit from HIGHLY superior hand soldering skills. If you are going to concentrate on through-hole designs then you will need to work on the hand-soldering that much more, you really do benefit from hundreds of hours of refined technique. Use Kester No. 44 solder, it's the last remaining top-performer. You would be wasting your time using any other solder until you are a technical expert at knowing why a different formulation or quality might be occasionally needed for a particular project. Until then develop a baseline using No. 44 so you will be better able to detect the deficiencies resulting from lesser formulations, such as lead-free, in case you do have to go there. Wear your safety glasses and have adequate ventilation, but not enough breeze to affect the cooldown profile of your soldering. To really get good you need to do it every day. You can go really far in analog with only hand-soldering. Pay attention to what you are doing, don't grab the hot end of the stick. Sure is a lot faster and more effective than solderless breadboarding.

For surface-mount assemblies, you will need oven-based soldering. For this it is probably best to join with a makerspace if you can, where they already have a bit of a PCB lab set up. Your're really going to need to work with surface- mount parts to get very far with digital.

Among so many different branches of electrical study & experimentation, one thing that may be most in common is Power Supplies. Knowing about power supplies can not hurt you, the more you know the better, plus add experience to that knowledge. But consider whether you want to concentrate on Power when realistically you may be buying so many kinds of inexpensive power modules (especially surplus) rather than designing your own for most projects.

A scrap CRT monitor or old TV to unsolder parts & wire from, a $10 30W radio shack iron + some special-ordered Kester 44, and you should be able experiment until you have some simple analog circuits under your belt. You can probably best start out powering little projects with a 9v battery.

hope this helps, dano

</comment><comment><USER4> Sounds to me like you want the knowledge of a Technician, and NOT the knowledge of an Engineer. For a technician's knowledge, pick up a robotics book for hobbyists, and that will get you started.

[Please note that I REALLY want to encourage you to follow an engineering path. The rewards will be amazing. See my list at the bottom on how to do that.]

Also, you need to ask yourself what you'll be using the Arduino and RasPi for. In particular, what types of applications? Power electronics/motor drives? Communications electronics? Audio amplifiers? Active filters? You want to use op-amps? Are you doing analog signal processing? Digital signal processing? Feedback control systems? Are you interfacing to an FPGA or PLD? etc.

The moral of the story is: Electronics is a HUGE area.

If you really want to fully understand electronics, please take the following courses IN ORDER:

1\. Differential Calculus

2\. Integral Calculus

3\. Multivariable Calculus

4\. Differential Equations

5\. Circuits I (1st and 2nd-order circuits, and higher)

6\. Electromagnetics (from Physics II is enough)

7\. Analog Electronics (Active filters, etc.)

8\. Digital Electronics (VLSI, etc.)

9\. Digital Logic (Boolean algebra, computer architecture, etc.)

10\. Power Electronics (Rectifiers, inverters, etc.)

Before you know it, you'll be an expert.

Good luck!

</comment><comment><USER5> I'd look at the discrete stuff before looking at arduino and raspberry pi. Start slowly and build some kits. You need to learn to solder and you need to learn how to "debug" hardware. You also need to get some tools. If you start small then it should be cheap(ish). Once you get a hang of the practicals you should look at the theory as mentioned in another comment. Back in the day 25 years ago I was amazed at my first job after graduation, several of my co- graduates had never used a soldering iron let alone built real things. Have fun

</comment><comment><USER6> Electronics is a massive field. From just simple wiring all the way to electrical engineering, and even beyond to eletromagnetic optics.

Where do you want to start and what do you want to learn?

<comment><AUTHOR> Well really I'd like to start with simple circuits, eventually moving on to working with arduinos and the raspberry pi.</comment></comment>


12 Learnings As a Startup CEO (Jobster, ~$48m in VC) - <AUTHOR> http://www.socialmedian.com/2008/01/12_learnings_from_my_first_sta.html

<comment><USER2> I can't say this enough, or nearly as well:

        Try to ride some powerful existing waves vs. just creating new waves.  Find some big and important industry trends and ride on top of them.  It is very very hard to create your own industry trends.  Be careful about getting out too far ahead of any wave.

It is where I made a major error - getting way out in front of the wave.

<comment><USER3> I agree. I think the article basically summarizes what we have all learned (the hard way) ... ahead of your competitors but never too far ahead of your customers.

</comment></comment><comment><USER3> This is a fantastic article summarizing what I have learned and what I tried to write on my own (<http://www.startupforless.com>).

I am humble by it.

Basically it boils down to the following ...

1) Create "value", not "valuation" 2) Be a "surrogate" customer, live their lives and adopt their persona 3) Be frugal, use your VC money as working capital and treat it as the last money you ever going to have and need 4) ... and more

\--Denny--

<comment><USER4> From <http://ycombinator.com/newsguidelines.html>

_Please don't sign comments, especially with your url. They're already signed with your username. If other users want to learn more about you, they can click on it to see your profile._

<comment><USER3> Thanks. I am from the old World.

<comment><USER5> That'll learn ya.

</comment></comment></comment></comment><comment><USER6> As a former startup CEO, I think Jason pointed some really good pointers on priorities and what it takes to make it. I'd like to see more articles like this from other CEO's.

</comment><comment><USER7> Learning #1: "learning" is not a noun. You can't have "learnings". You can have knowledge. You can learn things. Saying you have "learnings" makes you sound retarded.

<comment><USER8> Part of speech in English is determined by word order. If you attach "s" to "learning" it simply forces it to become a noun. It's not proper in the books, but neither was "Google" a verb 10 years ago.

<comment><USER7> While I agree that you're right -- English is not an especially logical language, and one that is quite fluid -- I think what I'm really hoping is that ugly corporatisms like "learnings" and "planful" don't get their ugly roots very deep. I'm also arguing that "learnings" is unnecessary (as is "pushback" and "monetizing") because we already have words for the idea.

</comment></comment></comment><comment><USER9> Learnings? From looking at his site, it doesn't appear that english is his second language. Lots of stuff on valleywag about jobster, e.g. [http://valleywag.com/tech/startup-hell/jobsters-death- march-...](http://valleywag.com/tech/startup-hell/jobsters-death- march-267843.php)

<comment><AUTHOR> Having worked at Jobster, I can safely say that 95% of the stuff on Valleywag about Jason is just plain wrong or horribly exaggerated. Pointing people there is the startup equivalent of pointing people to the National Enquirer.

<comment><USER9> I used to love the National Enquirer ;-) I love Valleywag too.</comment></comment></comment>