No more rock stars: how to stop abuse in tech communities - <AUTHOR> https://hypatia.ca/2016/06/21/no-more-rock-stars/ <comment><USER2> There should be no abuse - sexual or otherwise - in tech communities. Please call it out whenever you see it, in a polite but firm manner, and don't be afraid or intimidated by it. The vast majority of people will support you, and it's important to do so not only for your own protection but for others that might not be so willing or able to do the same.

That said, something about the tone of this blog post is utterly repellent to me and I'm struggling to put my finger on the reason why.

<comment><USER3> There's a weak undercurrent of condescension in the post (I've seen worse from Model View Culture); you may be picking up on that.

I'm more interested in the un(der)examined assertion that, when it comes to accusations of sexual misconduct, the accused should have a presumption of _guilt_. Have there been any published arguments in favor of this?

<comment><USER4> > the accused should have a presumption of guilt

That may be how social media work, that's absolutely not how justice should work. Anybody can be accused of sexual misconduct on social media. It's not justice when one can't defend himself.

<comment><USER5> It's not justice when we put the victim on trial (As we do in most rape cases), but we do it anyway.

<comment><USER6> This is flat out wrong. In the US/EU, you can't be put on trial for being a rape victim. What offence would that be? Complete hyperbole.

<comment><USER5> Read any rape trial transcript, or even an account of someone who took their assault to trial. Read the questions asked the victim. They are invasive and degrading, and they are intended to paint them as scandalous, lying, drunk, promiscuous skank. Your personal and public credibility will be put under intense scrutiny.

The accused then takes the stand, and insists that yes, you clearly consented to being assaulted at 2 am behind a dumpster, when you were too drunk to speak.

And if, heaven forbid, the case falls apart, you'll likely be sued right back for slander, damaging your attacker's public image, loss of income, etc.

That's the defense's job in an adversarial legal system. That doesn't make in any better for victims.

</comment></comment></comment></comment></comment></comment><comment><USER7> I'm really glad that someone is raising this issue. This 'rock star worship' culture is rampant in Open Source communities. What's worse is that many of these 'rock stars' don't do anything except blog and give talks at conferences - Their main goal is self-promotion. They don't give a shit about the actual project or the community.

You rarely hear about open source developers who focus on one project and produce amazing work over many years - These developers are too busy actually writing code and promoting the project to care about promoting themselves - Because they understand that their project is more important. A good open source developer sees themselves as a servant to the project, not the master.

I think a big problem in the tech industry in general is that there is too much focus on people - I'm sick of hearing investors say "We invest in people, not products" \- I think this sends the wrong message and attracts the wrong people.

The product should always be more important than the people who built it - People who agree with this statement are the ones we should invest in because they're the ones who will actually create value for society (as opposed to merely capturing value which others have created).

<comment><USER8> That's a separate issue from saying that rockstar syndrome leads to sexual abuse though. It's not really fair to use a boogieman like that to make the case against rockstar worship. If it's a bad idea, it can be argued against without the rhetorical leap made here.

<comment><USER9> _One_ problem with rockstarism is that it can create safe havens for abusers. But there are all sorts of other concerns. I'm surprised to see people defending it here; HN has always struck me as a community that is pretty cynical about rock stars.

<comment><USER10> Cynical yes, but some people do really good work and just end up in the position because of it.

Too much painting with a broad brush and trying to redefine a word normally reserved for an Ace team member.

<comment><USER9> I think that's a feigned concern, and that HN's cynicism about the term "rock star" far predates this post.

</comment></comment></comment></comment></comment><comment><USER9> Even if it hadn't resulted in a rash of sexual assaults in the security/privacy community, much of the advice in this post about avoiding rock star dynamics would be well taken. Rockstarism is a scourge in software security. It's probably bad everywhere it crops up, including the music industry.

<comment><USER11> It certainly did nothing good for the video-game industry. _cough_ Daikatana _cough_

I think you're right, and the "rock star" pattern looks similar wherever it crops up, with similar fallout. It's only the tolerance for it which varies.

<comment><USER12> John Romero was a rockstar, but his attitude only affected Ion Storm/Daikatana, not other people. And that was more than a decade ago.

<comment><USER13> Ion Storm had more than one employee.

</comment></comment></comment></comment><comment><USER14> With the exception of the "assume guilt" recommendation (which seems ripe for abuse), I think these guidelines are mostly fine. But calling abusive people "rock stars" seems unnecessarily controversial. Better to use the accurate and unambiguous "abuser". That describes Jacob Applebaum far more clearly than "rock star".

Also, I think a term like "rock star" (in the benevolent sense) is a useful one. There are people who are _really_ talented (and know it), who love the limelight, who sometimes say controversial things, and who have contributed more to our industry than any of us could hope to. I'm talking about people like Daniel J. Bernstein, David Heinemeier Hansson, Theo de Raadt, and (of course) Linus Torvalds. If we're going to give "rock star" purely negative connotations, I'm not sure what what to call these people. "Badass" would work, except some social circles frown upon profanity.

<comment><USER9> Rock star abusers are a subset of abusers, so your proposed change doesn't work.

Try to give the piece the most charitable possible interpretation. Leigh Honeywell knows more about Daniel J. Bernstein and Theo de Raadt than most people on HN. There's an interpretation of this post that suggests she's claiming that DJB and Theo are abusers, but common sense --- we don't even need charity! --- tells us that's probably not what she's saying.

<comment><USER14> If you want to just focus on what you call "abusive rock stars", then I think the most accurate term is "abusive charlatan". That covers the lack of skill as well as the fame-seeking.

In terms of reading charitably, I'm sorry to say that you're the one who needs to do more of it. I never implied that the author might be accusing those people of abusive behavior. In fact, that idea didn't even occur to me until you mentioned it. I was just giving examples of good "rock stars" in our field.

My issue is this: There are plenty of existing terms that accurately describe what the author is talking about. If she manages to redefine "rock star" to be purely negative, it robs us of a useful word. And because of that, a lot of people are going to be against her definitional change. (As evidence, just look at this HN thread.) She could gain more support by avoiding this definitional fight.

<comment><USER15> I'm with you on this one. I don't like abusers and assholes, but I like the title, and intend to continue to use it in a positive light, sparingly, and with good purpose. In my interpretation of the title, some rock stars are jerks, others are actually pretty good people.

When I used to work in politics, after he did a great speech at the DNC convention, I called Obama a "rock star" that was going to go on to big things. That was long before he announced his run for presidency. Mind you, I didn't even vote for him and I said that (I proudly throw my presidential vote away for the Libertarian candidate every year).

That title works best, naturally, when it isn't diluted down in crappy job postings.

I'm all for tossing out abusers here, don't get me wrong. But honestly, as perhaps the only person here that has ever actually contracted a form of Cholera (long story), I still wouldn't want to live in a world that's only plumbers, and I don't think you would either.

<comment><USER9> I'm harping on this, I know, but I really don't think the goal of this post is to get people to stop using the term "rock star", and the fact that people keep suggesting _that 's_ the controversy makes me worry people haven't really read the piece very carefully.

<comment><USER15> Subtly equating abusive behavior with people that are energetic and ambitious is clearly baked into the nature of this conversation and that particular facet is quite controversial to me, and to a lot of people here that are likely as concerned about abusive behavior as I am.

We don't need to institutionally get rid of "rock stars". Their ambition for attention and fame is a recipe for a lot of great things. What I think we really need here is to get better at not enabling them to be abusive, and for calling them out when they are.

I also do think we need to get better at choosing who our rock stars are, an opinion I got a long time ago from watching Limp Bizkit win a music award.

</comment></comment></comment></comment></comment></comment><comment><USER16> It seems like they are redefining rock star in the "A rock star likes to be the center of attention." paragraph. I am getting a little sick of the trend[1] of redefining a word to mean something else. Given this, a genuine complement of calling someone a "rock star" should probably be met with a hostility.

The line "A rock star appears in dozens of magazine profiles – and never, ever tells the journalist to talk to the people actually doing the practical everyday work." is particularly galling. If you are not doing the work, how the heck would you legitimately be called a rock star?

I think the love of tearing down people is echoed in the love of taking words that meant exceptional and making them mean destructive things. Hero and hero words die far too often.

1) its been going on a long time and sometimes I think its an insider trick to know who to award grants to (e.g. "empowerment" was my personal favorite).

<comment><USER17> _" A rock star likes to be the center of attention."_

That describes many CEOs and founders. The VC system today values the glib attention-seeker. So does Kickstarter, where the video of the presenter is often more important than the product. Society as a whole today rewards the attention-seeker. There was a time when self-promotion was considered an embarrassing lower-class trait, associated with door to door salesmen and such. Today, we have Donald Trump.

"Attention seeking" and "asshole" are independent. Making your organization asshole-resistant can be worthwhile. Read "Assholes, A Theory", by Aaron James. There are people who want attention but aren't assholes; many actors are like that. There are assholes who don't want attention, just power - they're found in dysfunctional organizations.

<comment><USER16> Ok and I partially agree, but I'm not arguing that point. I'm trying to figure out why someone is taking a commonly used term for someone with a high achievement level and turn it into crud. Why couldn't they have said "attention seeker" or "asshole"? Why does "rock star" need to be redefined as an insult?

Whatever I think about attention seekers[1], I am much more offended by this constant need we seem to have to tear down people who were heroes and with them the words we use to describe our heroes. This churn is bad for us. [edit: obviously anyone who actual did what was said needs to be more than torn down, but that doesn't mean the words need to be burnt]

1) and oh, boy howdy to I have some strong opinions on them including a rant that involves being lied to and almost getting killed by cattle.

</comment></comment></comment><comment><USER18> To keep out bad actors, it's very important to have an accurate model of what those bad actors are like and how to recognize them. The correct word for this is not "rock star", it's "psychopath". Equating the term "rock star" with bad actors is not going to accurately guide people's attention where it needs to go; instead, it'll lead to attacks on honest people who happen to have accumulated prestige. Those are the very people who have the ability to spot and push out the psychopaths. But if they're forced into conflict with feminists, they won't be doing that.

<comment><USER19> "Rock star" isn't a description of what a bad actor looks like, but it is a description of treatment of people who have high performance on one axis which empowers those that happen to be bad actors in manners unrelated to that axis and disempowers their victims.

Keeping out bad actors is desirable, but never going to be 100%. Avoiding creating the power dynamic which enables abusers to flourish is also important.

</comment></comment><comment><USER20> That is an extremely long bow to draw...

the author seems to have picked up on a case of a narcissistic possibly deviant and then tarnished all people who excel / lead with the same brush.

this reeks of tall poppy syndrome, i can't even believe what i'm reading.

</comment><comment><USER17> Reworking entire organizations to deal with one jerk is overkill. Applebaum has a Wikipedia entry, which is worth reading.[1] He's been kicked out of the Tor Project, the Cult of the Dead Cow (an old and respected hacking group), and Noisebridge. They all seem to have dealt with the problem. But he does have his supporters.[2] Reading all this, it looks like a routine jerk problem. None of this has led to criminal charges. I dunno.

[1] [https://en.wikipedia.org/wiki/Jacob_Appelbaum](https://en.wikipedia.org/wiki/Jacob_Appelbaum) [2] [https://assets.documentcloud.org/documents/2858953/Statement...](https://assets.documentcloud.org/documents/2858953/Statement- Appelbaum-11-06.pdf)

<comment><USER9> "None of this has led to criminal charges. I dunno."

Can you just come right out and say whatever it is you're implying with those last two sentences? Thanks!

<comment><USER21> He implies the obvious: the evidence is hearsay that hasn't stood up in court (and apparently nobody is even trying) - though it seems to suffice to ruin the guy's life.

<comment><USER9> Maybe we should let him answer for himself? Thanks.

</comment></comment></comment></comment><comment><USER8> > One of the authors of this post believed every first-person allegation of > abuse and assault by Jacob Appelbaum – including the anonymous ones – > immediately. Why? Among many other signs, she saw him break different, > smaller rules in a way that showed his complete and total disregard for > other people's time, work, and feelings – and everyone supported him doing > so. For example, she once attended a series of five minute lightning talks > at the Noisebridge hackerspace, where speakers sign up in advance. Jacob > arrived unannounced and jumped in after the first couple of talks with a > forty-five minute long boring rambling slideshow about a recent trip he > took. The person running the talks – someone with considerable power and > influence in the same community – rolled his eyes but let Jacob talk for > nine times the length of other speakers. The message was clear: rules don't > apply to Jacob, and even powerful people were afraid to cross him.

This is a really dangerous line of thinking. Just because someone is a "jerk" _does not_ mean that they're a criminal and the burden of proof for accusations goes out the window. This whole post, and the site it links to reeks of vigilantism. If he really did do the things he's accused of (I've never heard of Jacob before so can't comment), he should be dealt with by the proper authorities. It's not up to employers to act as judge, jury and executioners.

I would also add that people who engage in these types of public witch hunts and calls for codes of conduct, new rules... are very much showing signs of the narcissism they claim to be against.

</comment><comment><USER22> Some programmers are dramatically better than others......some of those top programmers are jerks, some aren't (just like every segment of society).

I always called those top programmers rockstars, but apparently that's the wrong term.....what should they be called then?

<comment><USER8> > I always called those top programmers rockstars

That was a well known usage for the term. This blog post is trying to redefine "rockstar" but you/we don't have to go along with the language policing.

</comment></comment><comment><USER23> In the list describing "a few signs that help you identify when you have a rock star instead of a plumber", it seems like you could replace every occurrence of "rock star" with "jerk".

<comment><USER9> No, you can't, because most jerks do not have fandoms, and most jerks don't generate fawning media coverage. The social power abusive rock stars accumulate is what makes them so problematic.

</comment></comment><comment><USER24> It's decent advice for larger organizations. At startup-sized orgs you're bound to have people with disproportionate amounts of power (and often it's a good thing). I hate to be pessimistic but I think instilling a deep sense of moral wrongness of certain actions and behaviors is what you have to do in order to have real impact.

</comment><comment><USER25> I absolutely agree that 'rockstarism' is hugely problematic (I agree with tptacek's sibling post on the topic).

That said, some of this post feels worryingly like it's pushing 'truth by association' to me. I'd love to hear each of the recommendations herein discussed on their own merit and with clear reasons given for each one.

That is, I wouldn't encourage anyone to conflate fighting narcissism and arrogance with quashing openness, confidence and self-respect in a demographic (engineers) which arguably already has trouble with those - irrespective of the gender of the engineer.

</comment><comment><USER26> Rock stars are good at what they do and most of the time earn that label. Don't form a gang and hurt productivity of your team/company. If someone is working hard to earn a rockstar label don't penalize them.

You will probably need rock stars and plumbers getting along well. If someone is a bad employee rockstar or otherwise that needs to be dealt properly.

<comment><USER27> I'd say my biggest complaint about the term "rock star" is that its nonstandard. This article uses a definition, which describes a set of people I know in tech communities. Your comment is probably referring to something else.

Regardless, the article is spot on in describing what to do to produce healthy environments, whereas most uses of the term rock star that I've found come from unhealthy ones.

</comment></comment><comment><USER28> " _Watch for smaller signs of boundary pushing and react strongly_ "

But we'd have to fire all the first-level problem report handlers of most of the open source projects I've dealt with.

</comment><comment><USER29> This one:

        Avoid organizations becoming too central to people's lives

Seems at odds with this one:

        Enforce strict policies around sexual or romantic relationships within power structures

Due to the use of the terms "organization" and "community" instead of "company" or an equivalent, it's unclear if they are referring entirely to employment (where such a prohibition would be pretty common and mundane), or if they are also including open-source projects, where it would seem like a huge intrusion. Submitting an issue or pull request shouldn't have any effect on your ability to date someone.

<comment><USER30> I think it makes sense if you interpret it as having rules against seeing someone if you're in a position of power over them. If you happen to be in same organisation but have no power over them, there isn't a conflict.

<comment><USER29> Right, and that makes sense for companies, but someone should be able to make a PR against a Github project for which their wife is a maintainer.

<comment><USER30> I think these rules kind of all cease to apply at the marital boundary, and there new and equally troublesome rules take over :-)

</comment></comment></comment></comment><comment><USER7> Was this just taken off the HN front page?

<comment><USER9> Almost definitely not; rather, the post was probably flagged by users. This happens all the time, and your question is a very common one.

<comment><USER7> 'Flagged by users' \- Interesting. Do some of these users happen to be friends with 'Jacob Appelbaum'?

I understand, the whole system is rigged to praise rock stars and screw the plumbers.

<comment><USER31> I flag (using my non-throaway account) any article that only results in mob- and-pitchfork style discussion. Many comments in here are advocating that we should abandon the court and justice system (because its unfair to the victim, its too high requirements for conviction, ectra) in favor of just punishing the assumed guilty. I will keep flagging stories like this as long as that opinion still runs popular.

<comment><USER9> Flagging stories because you think they're off-topic for HN, or should be because of the threads they'll create, is legit.

Using the flag button as a downvote button for stories you disagree with, while allowing stories on the same topics you do agree with, is an abuse.

<comment><USER31> I find mob-and-pitchfork style of threads and articles to be off-topic for HN.

If someone posted an article about one of the accusers of JA and creating a mob-and-pitchfork threads against them, I would flag it equally the same as this one. If the only purpose of the submission is to attack people (see attack articles on Wikipedia for definition and concept), then its fail the first HN rule for the threads it will create, ie its not civil to have mob- and-pitchfork threads and its not something anyone would say in a face-to-face conversation with the accused or accuser. In a previous article discussion about JA, someone compared him to hitler. Do you think they would be perfectly fine say that in person?

>> any article that only results in mob-and-pitchfork style discussion > "while allowing stories on the same topics you do agree with"

If topic == mob-and-pitchfork; goto flag-article(). How could I have been be more clear in previous comment? All, any, and regardless if I like the person being attacked or not, I do not find such article to be civil and productive for discussion. I don't even find it productive for social change, as all it does is raising the tone and driving out those that social campaigns tries to convince. Left are those that are already convinces that they are right, flaming against each other.

</comment></comment></comment></comment></comment></comment><comment><USER32> First off, there is lots of different potential abuse in a tech community. Second, not all of it comes from "rock stars" \- the aggregate cases of abuse probably greatly outweigh rockstardom-enabled abuse. Third, the abuse was perpetuated not because Jake was a "rock star", but because your community's values suck and nobody would stand up and call him out, AND nobody cared once they did. This was primarily a failure of your community. But like I keep saying, this is a feature of all in-groups.

 _" Why are rock stars so common and successful?"_

Because communities like "leaders", and they have shit heuristics to determine it. And everyone loves an asshole, and there's tons of asshole hackers.

 _" How do we as a community prevent rock stars?"_

Stop being a community.

I'm serious. Communities breed power in individuals and it's been proven time and again (and "in studies", no less) that in an in-group, a person with power and low morals is more likely to abuse their power. It's inherent to in- groups. Remove the community, you remove the power, you remove the social and other influences that bring the immoral, not-powerful person into contact with the vulnerable. No community, no abuse.

 _" Our recommendations can be summarized as: decentralizing points of failure,"_

....What? This isn't an Active Directory tree, these are humans. Every node in your network is a point of failure.

 _" increasing transparency,"_

And what would that look like? Sending an e-mail to a listserv every time someone says something passive-aggressive to you? Again, there is no simple way to police the myriad of potential abuses, micro or macro, from all sorts of personalities.

 _" improving accountability,"_

Which, for a community that shuns the police, looks like what? K-lining him from your IRC server?

 _" supporting private and anonymous communication,"_

You already have that. This whole debacle has shown how anonymous communication is dismissed until a real face is put to a complaint, and many of them, all at once. This is pretty standard group dynamics, again.

 _" reducing power differentials,"_

So... everyone is an op. Nobody is allowed to like anyone else more, and everyone has to be invited to your party.

 _" and avoiding situations that make violating boundaries more likely."_

No more alcohol or drugs and nobody is allowed to be in a room alone with one other person, AND no PMs allowed, everything in-chat and logged. Got it.

\--

The points, one by one:

Codes of conduct won't be followed if the people enforcing the code of conduct don't enforce it. This is why there are police that police the police.

 _" Start with the assumption that harassment reports are true"_ \- if Jake had made the first report against his victim, now we would have to believe Jake. Default assumption of guilt doesn't work - this is why our own country's laws do the opposite. All the examples given of _" investigating for bad behavior"_ are things regular non-rapey people do all the time. _" nasty emails, stolen credit, rude behavior, and unethical acts big and small"_ ? That's every fucking hacker troll alive.

Making it easy for victims to find each other is not a good idea, because coordination leads, again, to failed heuristics: one person felt uncomfortable with a consensual act, another was actually violently sexually assaulted, and now the first changes their story so they're taken more seriously. (This is not something i'm making up to gaslight an invisible person, btw, this happens to real victims) It would, however, be GREAT if there were a community- specific organization that anyone could contact to discuss how they feel in a safe way.

Watching for boundary pushing and react strongly - yes, 100%.

Call people out for _" monopolizing attention"_ \- uh.... Right, popular female hacker scenester. Let's police the social convention of "taking credit for work" or "being loud and outgoing". You and I both know nobody's going to shout down the hacker media whores - and there are so, so many.

The _" deep bench of talent"_ thing is again, almost completely irrelevant to generally preventing abuse in communities.

You basically explained why your point about hierarchies is invalid, so no need to comment.

 _" Failing up"_ is a minor aspect of corporate hierarchy and has nothing to do with social or personal power in in-groups, this is not relevant to the subject.

And, sure, _" no relationships in the workplace"_. You go ahead and explain to Sally and Joe (or Jane, or Zed, or whatever) that Sally is going to have to support her kids without Joe's help because Joe needs to leave the company because you feel uncomfortable that they might one day have a domestic dispute.

 _" Avoid organizations becoming too central to people's lives"_ \- this really has zero to do with the subject.

 _" Distribute the keys to the kingdom"_ \- Same.

 _" Don't create environments for potential boundary violation"_ \- Like I said above - no drugs, no alcohol, never leave anyone alone with another person. Your parties are gonna be a blast. Chiptune, diet shasta orange, and vacation slides. Wheeeee.

\--

 _" We waited too long to do something about it."_

Correct. Now, next time, do something about it. That is really all that needed to be said and all that needs to be done.

<comment><USER10> Well said.

Although I think it needs to be pointed out that sometimes, someone is a Rockstar because they earned it. Which seems to be a possibility left unexplored in this piece.

</comment></comment><comment><USER33> Don't sleep with people you work with. Don't drink if you can't control yourself or can't trust the people you are with. Don't do drugs if you can't control yourself or trust the people you are with. Problem solved!

<comment><USER34> Wow, that's hugely insensitive. Why not try it from another angle and save on typing: "Don't abuse people. Problem solved!"

<comment><USER33> Well I agree with that statement as well. However, it never hurts to take preventative measures in one's own life, instead of letting yourself get screwed over and then wondering why it happened and who to blame.

<comment><USER34> Victim blaming is pretty insensitive though, as is "letting yourself get screwed over". There was an infamous case in Australia where a cleric responded to gang-rape by members of his community by labelling young girls in skirts as being like raw meat attracting animals. The implication was "of course the animals will want to eat the meat".

Yes, the reality is that if you never leave the house, live in a panic room, cover your entire self at all hours, etc you reduce the risk, but ultimately the action is on the abuser rather than the one being abused and that is where we should direct criticism, especially in immediate/direct response to something like this IMO.

What are we ideally working towards? A world where everyone must avoid a defined level of risk (including certain level of dress!), or one where any of us can walk anywhere with an expectation that we won't be abused by another one of us? I'd like to think the latter.

<comment><USER35> > What are we ideally working towards? A world where everyone must avoid a > defined level of risk (including certain level of dress!), or one where any > of us can walk anywhere with an expectation that we won't be abused by > another one of us? I'd like to think the latter.

The latter...but we have to live in the world as it is, not the world that we hope to someday achieve.

If I were to put on a top of the line Rolex watch, pick up an expensive laptop in one hand, and $100k cash in the other hand, and take a stroll alone at night through a major city's most gang controlled, crime riddled, neighborhood and found myself involuntarily relieved of watch, laptop, and cash, I think people would be justified in putting some of the blame for the robbery on me even though I would also be the victim.

<comment><USER36> Well, if you _really_ didn't want to get robbed, you should have donated the laptop and cash to charity, donned a tunic and joined a monastery

</comment></comment></comment></comment></comment></comment><comment><USER37> Stopped reading at the trigger warning. When did the whole internet become a joke from PCU?

<comment> some-guy I suppose then you were "triggered" by the warning?

<comment><USER38> Some people are so sensitive, dontchaknow ;)</comment></comment></comment>


Mysterious Go Master Blitzes Competition (Master said he's AlphaGo's Aja Huang) - <AUTHOR> http://www.sixthtone.com/news/mysterious-go-master-blitzes-competition-rattles-game-community <comment><AUTHOR> The identity of Master could be Aja Huang of AlphaGo.

[https://twitter.com/oth_mirai05/status/816641830234112000](https://twitter.com/oth_mirai05/status/816641830234112000) [Translation: (Master [9D]: I'm Dr. Huang of AlphaGo)]

</comment><comment><USER2> Looks like it's AlphaGo: [https://twitter.com/demishassabis/status/816660463282954240](https://twitter.com/demishassabis/status/816660463282954240)</comment>


Implementing a JIT Compiled Language with Haskell and LLVM - <AUTHOR> http://www.stephendiehl.com/llvm/ <comment><USER2> I've implemented this toy compiler (minus JIT) in Java, following the tutorial on the LLVM website (which uses C). After browsing through the Haskell code, it is incredible how much more suitable a statically-typed, functional language is for compiler development when compared to an imperative language like Java. The code is much more terse and most importantly, readable.

<comment><USER3> Yes languages like Haskell and Lisp are excellent for compiler development, as a compiler is one big pure function that involves a lot of transformations on recursive data structures. And what are language academics interested in doing? Implementing languages. So the languages they design are often suited to that task.

<comment><USER4> Would you say something like Clojure is also suitable for compiler development or not?

<comment><USER3> Well any turing complete language is suitable for compiler development work, but yeah Clojure is designed around symbolic computation, recursion and things like that.

<comment><USER5> Can we stop pulling out this turing complete quip?

That's like asking on a cooking forum how to open a coconut, and the reply being well any physical object with mass can technically open a coconut with the correct application of force, but yeah, you should probably use a machete.

<comment><USER6> BTW, the guy you replied to is part of the team working on what is probably the most advanced compiler technology breakthrough in the last decade (Truffle/Graal). So he's not "technically right", but has actually contributed to the world's most revolutionary compiler (which is written neither in Haskell nor a Lisp).

<comment><USER5> I was replying to what he said, not who he is.

<comment><USER6> I think that's relevant context which proves that your analogy in this particular case is inappropriate. He's a chef working in one of the world's greatest restaurants and he's _not_ using a machete to open the coconut. Therefore, there are probably good reasons to prefer another tool and the advantages of a machete are probably not that big (or are offset by other factors). Again -- in this particular case.

So while the "any Turing complete language" is an over-generalization, so is "use the right tool for the job". Programming languages are not at all like knives or hammers as they are 1/ terribly expensive 2/ require constant training 3/ require specialization and 4/ each designed to be general-purpose. It's more productive to use just one language you know best than keep switching to a completely different one that's marginally better at the particular task at hand.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> This is common knowledge for a lot of people, but I have found the author's "What I Wish I Knew When Learning Haskell" article is awesome too:

[http://dev.stephendiehl.com/hask/](http://dev.stephendiehl.com/hask/)

</comment><comment><USER8> It just so happens that the author is hiring Haskell engineers right now to do related work: [https://twitter.com/smdiehl/status/642790047163375616](https://twitter.com/smdiehl/status/642790047163375616)

</comment><comment><USER9> Last semester for a compiler course I was taking we had to implement a compiler for a subset of Go (called GoLite), with free reign over language choices. I chose to implement a compiler[0] using Haskell and LLVM, this article helped a _lot_ when I was writing codegen, especially since it was my first real Haskell project.

However, some of the most interesting and important issues are left out of it. Some examples are implementing exceptions, threading, imports, garbage collection, closures , etc.. I would love a more advanced version of this article that discusses how to implement a more advanced compiler with more modern features (specifically in LLVM).

[0] github.com/xldenis/mgc

</comment><comment><USER10> Sorry for offtopic but anyone know performance benchmarks LLVM vs BEAM ?

<comment><USER11> They're not really comparable things. One is a bytecode VM (BEAM) and the other is a bunch of compilation infrastructure. As well, BEAM is optimized for heavy network-oriented concurrency and only incidentally is not-slow on a CPU. If you run a CPU-only race with a BEAM targeting language (Erlang, Elixir, LFE etc etc) you're going to be disappointed.

<comment><USER10> Thank you for the compare/contrast!</comment></comment></comment>


A New Constraint on the Drake Equation - <AUTHOR> http://online.liebertpub.com/doi/full/10.1089/ast.2015.1418 <comment><USER2> Personally, I find these miss one of the key points.

Today, we can kill everyone off with an exchange of the already existing nuclear weapon inventory. But that requires a reasonably large number of people to make mistakes or take action.

We're in the process of killing everyone off by screwing up the natural climate process which requires a large number of people to commit to inaction.

Within this century we will have the means and the understanding for a single individual to craft a DNA based pathogen that can infect and kill nearly everyone on the planet.

These are the three tests for graduation into the club of "long lived intelligent species." Fail any one of them and you don't make it. I call them:

       * Action of the group
       * Inaction of the group
       * Action of the individual

We apparently passed test 1, we're not doing so well on test 2, and we'll have to be a lot better at eradicating hate in individuals if we want to have a hope of passing test #3.

<comment><USER3> It's beside the point, but IMO the human species is at almost zero risk of extinction from climate change. Maybe you could find a better example. The worst case would certainly be a calamity, but it would require an _immense_ amount of additional failure for humanity to actually go extinct from it.

<comment><USER4> If we had loss of technological knowledge (say due to climate change induced conflict), it might not be possible in the future for the surviving humans to re-bootstrap back up to our our current technological level.

We have exhausted all the easily accessible minerals and fossil fuels (i.e. those resources that can be extracted using stone age tools). Any break in our current technological systems might make it impossible to recover for 10s of millions of years.

<comment><USER5> Like the article posted last week titled "this is not a place of honor" about making obvious markers on nuclear waste to last 10,000 years...

We may also want to invest in creating some "breadcrumbs" for a future civilization to build up from. Say, a reserve of easily accessible fossil fuel and other raw materials, and some long-lasting guideposts that indicate where to find them.

<comment><USER4> It is a good question of how much breadcrumbs you would need to jump from the stone age to using whatever accessible resources are left after us.

A lack of accessible fossil fuels is likely to be the major factor as it would be really difficult to get an industrial revolution going without access to the easy energy provided by fossil fuels. We could easily find a rebooted society gets stuck in a pre-industrial state with no way of breaking out.

</comment></comment></comment></comment></comment><comment><USER6> Michael Crichton tears up the Drake Equation (and SETI) pretty thoroughly in his speech entitled Aliens Cause Global Warming.

[http://stephenschneider.stanford.edu/Publications/PDF_Papers...](http://stephenschneider.stanford.edu/Publications/PDF_Papers/Crichton2003.pdf)

"...the Drake equation can have any value from "billions and billions" to zero. An expression that can mean anything means nothing. Speaking precisely, the Drake equation is literally meaningless, and has nothing to do with science. I take the hard view that science involves the creation of testable hypotheses. The Drake equation cannot be tested..."

-Crichton

<comment><USER7> The fact that the Drake equation can have any value from "billions and billions" to zero is precisely the point. There is a "right" answer and we can get closer and closer to it if we choose what to study properly.

We know a lot more about exoplanets now than we did in 2003. We're moving on to find out how many are in the Goldilocks zone, or how many contain water. Our idea of what to plug in is slowly getting better.

Pointing out that the Drake equation is technically not science since it doesn't involve testable hypotheses is pointless pedantry. Call it statistics then. Or metaphysics. Or a thought experiment.

<comment><USER8> "We know a lot more about exoplanets now than we did in 2003. We're moving on to find out how many are in the Goldilocks zone, or how many contain water. Our idea of what to plug in is slowly getting better."

"Unfortunately", that's nailing down the one parameter that nobody has ever particularly questioned. There's some lines of thought that our solar system might be unusual in relevant ways, but nobody has ever seriously argued that the only planets in the galaxy are in our system, or anything related to that that would make that parameter small.

It's all the rest of the parameters where the mystery is.

</comment></comment></comment><comment><USER9> One in 10^24 seems like really easy odds to beat. Basically anything should happen more often than that, right? But if we choose a random 17 letters of the alphabet, the odds that they spell "probabilistically" is less than that. If we gave 17 letters to each of the 10^24 planets, we expect the word to happen on only one star (actually less than one). It's not too hard to argue that life is more difficult to get by random chance than the word "probabilistically."

So before taking this article to mean that life is actually pretty likely, consider that an event having to occur at least one in 10^24 odds is actually extremely difficult for complex probabilistic phenomena. Who knows how likely life is, but we can't just assume it's higher than one in 10^24.

<comment><USER10> You're obviously coming down on the pessimistic side of the line but what's cool about this paper is that we now have a line in the sand to argue about!

<comment><USER9> I deliberately tried not to come off as pessimistic. I'd just seen a pop science article on this paper that went along the lines of "OMG, 10^-24? That's so small! Aliens are basically guaranteed!" It was totally exploiting people's lack of intution about numbers. I just felt the need to point out that 10^-24 is much more run-of-the-mill than it seems. The crazy thing is that probabilistic things are multiplicative, so it's all exponential. The difference between 10^-3 and 10^-4 is a single extra flip of a 10-sided die. The odds of life on a habitable planet might be 10^-10, it might be 10^-100, but you can be damned sure our uncertainty spans many orders of magnitude above and below 10^-24.

(edit: I just looked up the pop article I was complaining about. It was in the new york times and the title was literally "Yes, There Have Been Aliens." Hence my crankiness.)

</comment></comment></comment><comment><USER11> > We find that as long as the probability that a habitable zone planet > develops a technological species is larger than ∼10^−24, humanity is not the > only time technological intelligence has evolved.

I wonder how they turn a statement based on a probability into a statement that is an absolute truth (no probabilities involved).

</comment><comment><USER12> TFA has the same problem the Drake equation has in general. We lack the insight to judge whether -24 is a reasonable exponent. Why shouldn't it be -35, or any other number?

<comment><USER13> I don't think the paper is arguing whether it is a reasonable exponent or not. They are just saying IF the exponent is -24 or smaller, then there is more than one technologically advanced species. It makes no claim about how close to reality that exponent is.

<comment><USER12> Right, TFA is at least as pointless as the Drake equation itself.

</comment></comment></comment><comment><USER14> The universe is a really inconceivably big place. In fact they (the smart people) are not entirely sure that it isn't infinite.

Drake equation or not, seems such a big place that it seems hard to imagine that this tiny little spot is in some way unique.

<comment><USER15> You can use this same argument to conclude that there's an alien race that speaks French. Of course we know they don't: as big as the universe is, the possibility space of possible languages is much bigger. French is only spoken on Earth, not because French is unique, but because it's not unique.

But maybe, if everyone only spoke French, it wouldn't occur to us that other languages were even possible. We'd be trying to estimate how many French speaking aliens were out there.

Deoxyribonucleic acid is our French. Because it's all we know, we think it's special. But the possibility space is much bigger.

<comment><USER16> People have been thinking about non-carbon based life, so not everyone is thinking only about French, at least not all the time.

</comment></comment></comment><comment><USER17> What about ancient Vimana and places like ankor wat? Wouldn't that suggest that technological species happened at least twice on the same star?

<comment><USER18> Angkor Wat was built in the twelfth century AD, and is well within the known technological capabilities of the Khmer empire at the time.

A vimana, which from googling appears to be some kind of flying temple in Sanskrit myths, does not appear to have actually existed.

<comment><USER17> Vimana are not unique to India and there are references from all over the world and include the Egyptian Saqqara Bird, the pre-Columbian golden airplane models, the Greek Icarus legend, the Chariot of Ezekiel, the Nazca runways (lines), The Abydos carvings, The Tassili rock paintings from Algeria and the Chinese references to Lu Ban's wooden aircraft that flew great distances. Naturally, these references are often dismissed by modern historians as simply impossible but there can be no doubt that humanity has a collective memory of have once been able to fly in ancient times.

<comment><USER19> correctio:

> a collective memory of having once DESIRED to fly in ancient times

<comment><USER20> Or even just to have worshiped flying beings. Modern fiction is full of fantastical and impossible things. Are we to believe that people in the ancient world were incapable of flights of fancy and everything they wrote and made must be taken absolutely literally?</comment></comment></comment></comment></comment>


Typography: On the creation of the Biden Harris campaign logo - <AUTHOR> https://www.typography.com/blog/biden-harris-logo <comment><AUTHOR> > […] how do you create a logo without knowing for certain what the words will > say? […] brute force: you just design all the logos you can think of, based > on whatever public information you can gather.</comment>


Betrayed by the Android UI [slides] - <AUTHOR> https://docs.google.com/presentation/d/1Ya2BThnbkXzAtXR3zh9SAiLAZ_mC3nYt8Zxm-KAIqZ4/mobilepresent?slide=id.p <comment><USER2> Talk: [https://youtu.be/BmXaMaxx7OY](https://youtu.be/BmXaMaxx7OY)

And/or [https://youtu.be/FRpcGwCedZ0](https://youtu.be/FRpcGwCedZ0)

</comment><comment><USER3> There should be some very basic safeguards to help users discern what is "real" in the UI:

1\. Every user should be able to select a custom color and pattern, e.g. to display around the border of system UI. This should be stored in such a fashion that an app can't simply "guess" what color/pattern to show in a fake UI.

2\. Part of the "set up new device" overview for all new users should be to remind them what the UI is supposed to look like.

3\. For crying out loud can we move away from these simplistic, ugly UIs. I'm tired of looking at unimaginative colored rectangles on machines capable of displaying cool, photo-realistic artwork. Make Google/Apple/etc. hire entire teams of hundreds of artists to create cool, extremely-difficult-to-render UIs with beautiful buttons, etc. and then bad actors won't be able to just hack together a real-looking UI in 5 minutes.

<comment><USER4> > For crying out loud can we move away from these simplistic, ugly UIs. I'm > tired of looking at unimaginative colored rectangles on machines capable of > displaying cool, photo-realistic artwork. Make Google/Apple/etc. hire entire > teams of hundreds of artists to create cool, extremely-difficult-to-render > UIs with beautiful buttons, etc. and then bad actors won't be able to just > hack together a real-looking UI in 5 minutes.

While I agree that today's phone UIs are boring, I don't think replacing them with photorealistic, "extremely-difficult-to-render" UIs is a good idea -- nor would that protect against imitation by malicious app publishers.

Usability would go straight out the window. Every menu in every app would become an assault on the eyes, or at least an incredible nuisance. UI elements should be clear and consistent, and should stay out of the way.

<comment><USER3> There are lots of ways to render beautiful, unobtrusive UIs that are difficult to emulate. For instance, a Retina-detail polished metal button would be readable and look good but it would be non-trivial to recreate (unlike our current login dialogs that could practically be recreated in MS Paint). It would be especially secure if it included personal information, e.g. an etched-in-metal appearance of your full name.

</comment></comment></comment><comment><USER5> Slide decks like that make me happy that Apple make developers jump through a few extra constraints and approval loops.

<comment><USER6> I have been working on both platform for a while.

Sorry but I don't believe the App Store approval process make any difference in that regard.

Apple does make your app run in a sandbox to try to detect known malware, just like Google does for the play store.

As for the other parts of the review process, 99% of why they are here seem to be to protect's Apple interests (cf spotify).

<comment><USER7> App Store review isn't great, but iOS's implementation of these APIs (or lack thereof) are _very_ effective.

</comment></comment></comment><comment><USER8> why is this not available as static webpage? it's difficult to read as slides

<comment><USER9> Or just a pdf.

<comment><USER10> You can download it as a PDF here (File -> Download as -> PDF):

[https://docs.google.com/presentation/d/1Ya2BThnbkXzAtXR3zh9S...](https://docs.google.com/presentation/d/1Ya2BThnbkXzAtXR3zh9SAiLAZ_mC3nYt8Zxm- KAIqZ4/edit#slide=id.p)

</comment></comment></comment><comment><USER11> Slide 17:

Google: Hey so we had this new thing called FLAG_WINDOW_IS_OBSCURED

Me: Really? Google? You're going to fix your problem by telling everybody to watch out your problems?

</comment><comment><USER12> Just curious, is this restricted to Android only?

<comment><USER13> A lot of this is not possible in iOS, because it doesn't allow drawing on top of alert type messages. The attacks relating to password managers are probably still relevant. Possibly so are the ones relating to accessibility, although I don't think iOS allows accessibility controls access like Android does.

<comment><USER14> So the question is whether the trade-off of accessibility capabilities worth the decrease in security?

<comment><USER15> In general terms, iOS accessibility is far greater than Android's.

I would say this is more akin to a feature than accessibility, in practical means...

<comment><USER7> iOS does accessibility natively and does not allow apps access to it to the extent that Android does, AFAIK.

</comment></comment></comment></comment></comment><comment><USER16> Interesting slides, I wish we could hear the presentation audio. What's going on in slide 22?

<comment><USER7> I believe it's demonstrating accessibility attacks (though, I don't have the audio myself so I could be wrong). In the first case it looks like the password text field is blocked so accessibility is used to grab the code while the user types it in, in the second a two-factor code is pulled from the Authenticator app, and in the last the phone's passcode is recorded as the user types it in?

Edit: watched the video of the talk linked above; the above descriptions seem to be accurate</comment></comment>


The Case for Git Rebase - <AUTHOR> http://darwinweb.net/articles/86

<comment><USER2> I'm using rebase a _lot_ right now. Our designer is currently going through our main development branch and is ripping things apart, redoing styles, etc. At the end, we were faced with a mega-merge back into our develop branch of his extensive changes. Instead, he just pushes his visuals branch out and we rebase our topic branches against it. That means no massive merge session at the end, as all the conflicts are resolved by the people who created them. Simple as pie.

</comment><comment><USER3> I've been using git for little while now, and started out using rebase in the manner described here. I did some experimenting first using gitk and a few git branches to grok what rebase actually did, and then figured I pretty much always wanted to rebase, unless working on a branch that was 'public' (which other people will pull from).

So my strategy has been, rebase for all local branches, merge for all public branches.

That being said, I'm still quite new to git, so if anyone can explain why that strategy is flawed, I'm happy to listen.

<comment><USER4> I sometimes it's useful to use merge to "group" a large set of changes that all relate to one feature.

That said, if I'm working on a branch for any significant period of time, I tend to push it to the remote repository anyway. It keeps it safe and shows people what you're working on.

</comment></comment><comment><USER5> My impression is that rebase is used as a palliative to a short coming of log history display. It would be indeed useful to be able to show only key merges/commits log messages. This would imply adding some kind of level to the logs so that they can be collapsed like function code in modern code editors.

<comment><AUTHOR> That doesn't help git-bisect which is really the most significant of the three issues.

</comment></comment><comment><USER6> Merging and rebasing both have their benefits and use cases. Just do not fall for the "squash everything into one commit and rebase" BS recently afflicting otherwise rational people.

<comment><USER7> I can see squashing a bunch of commits when you make 30 junk commits just so you can push them off your box for safe keeping. Assuming that no one is gonna pull from where you pushed, or you just don't care about other people, I see no problem with that as long as the new commits are smallish discreet units. Making huge commits will hurt you when you try to git-bisect.

</comment></comment><comment><USER7> Rebase is useful. Someone said it was like a boomerang with a chainsaw on both ends. You better pray that it doesn't miss it's target and come back to get you.</comment>


Ask HN: Education Reform Movies? - <AUTHOR>

I feel kinda funny asking this question to this community, but can you all suggest movies that depict educational reforms?
The story behind it is not very fascinating. We have a new robotics club at our college where we also put aside some time for non-technical things. The volunteers hit upon the happy idea that we should make a interesting report to be sent to our university (we are a private one so the office is in the area....somewhere). The title will be "What ideas for educational reforms can a student get by just watching movies". So now we are all looking for movies which we will show to the group and make notes on them and then forge a report on the feasibility and prospects of such reforms in college education. We have two movie lined up the recent hit in India 3 Idiots by Amir khan and one of my favorite Accepted.
I request you all to contribute more movies in this genre. The language must be english and hindi.Dubbed movies will also do...I think. <comment><USER2> First I'd like recommend these interviews as an interlude, for your robotics club especially the one with Larry Rosenstock from High Tech High: <http://www.mobilelearninginstitute.org/21stcenturyeducation/>

This has an angry little trailer, but seems to more about Amerian campus politics than educational reform: <http://indoctrinate-u.com/intro/>

"We are the people we've been waiting for" has a focus on education reform in Great Britain: <http://www.youtube.com/watch?v=VRi8_fXz1D8> and <http://youtube.com/WeAreThePeopleMovie>

Plus there's a two or three kickstarter projects on documentaries in education. Hope this helps!

I will dig around and try to find a few more. The one's Jon Bischke posted sound good as well. Take care!

</comment><comment><USER3> I don't know if these are exactly what you are looking for but try the following:

-A Touch of Greatness -The Class -The War on Kids -Declining by Degrees: Higher Ed At Risk

I'm incredibly passionate about this topic so will be interested to see if any one else adds anything here.

<comment><AUTHOR> I too am very passionate about the subject. The suggestions are great but they are more highschool oriented. We want something which has college culture in it. You know how they bore us in class while we could learn much more outside building things.</comment></comment>


Help me buy body armour so I can safely do my job in Egypt - <AUTHOR> http://www.indiegogo.com/projects/help-me-buy-body-armour-so-i-can-safely-do-my-job-in-egypt

<comment><USER2> Let's see... Two weeks to raise the cash. How long does it take to get body- armor shipped out? I'm afraid this photo-journalist is going to miss the revolution (or brutal suppression thereof)! Also, why ask for charity to cover what should be priority job-related equipment for someone working in dangerous areas of the world? It's like an enthusiast snowboarder who thinks he's a pro asking for hand-outs to buy himself a brain-bucket. Either your job can pay for the equipment it requires or your job is really just your hobby.

Finally, if you're really in urgent fear for you life, would you start a two- week fund-raising drive or would you suck it up an pay the cash yourself to get it pronto? The amount of cash she's asking for could be put on the average person's credit card without a problem! When your life is on the line, would you really worry about racking up a little interest? This actually sounds like a scam to me.

<comment><AUTHOR> There are a lot of young freelance journalists operating in Cairo. They don't make enough money to pay for their equipment.

I am based in Cairo - this conflict is not going to end anytime soon.

<comment><USER3> Raise prices or exit the market then. If you can't get paid adequately for your freelance work then it's probably superfluous; meanwhile there are other places and events that are drastically under-reported. I'd be more impressed if it were 'help me buy body armor so I can go somewhere that never gets photographed, but should.'

<comment><AUTHOR> Egypt is an entry level entrance to war reporting because you can move pretty much independently and the violent protests usually limited in certain part of a city so you can usually enter/exit safely if you survived being inside the clashes.

War reporting freelance is not like web design freelance. You have to be in located and get shot at and in the beginning, you barely get paid because you have to build your experience.

edit: Also that being a Western Woman, she stood out in the clashes and it made her job even more dangerous.

</comment></comment></comment></comment><comment><AUTHOR> I am a developer currently located in Cairo. Above link is not mine but what she says is true. Right now is probably the most dangerous time for journalist to cover clashes in Cairo.

In the past few days we have seen the emergence of AK-47 armed 'protesters' against the security forces. Usually protesters uses rocks and molotov cocktails to fight so journalists only have to worry about birdshots from security forces.

Egypt now ranks the 4th most dangerous place in the world fo 2013 [http://www.cpj.org/killed/2013/](http://www.cpj.org/killed/2013/)

<comment><USER3> It sucks that your country seems to be headed for civil war. What do you think would lower the probability of that happening?

<comment><AUTHOR> Egypt is not my country. I just been living here for the past 7 years.

The country is not going to have a civil war. There is not enough support for the Islamists to wage an insurgency at least on the African side of Egypt. There is already an insurgency happening in North Sinai but that's also because that area borders Gaza and Egyptian military is not allowed to deploy significant amount of soldiers and equipment due to Camp David Peace Agreement with Israel(edit typo).

Worse case scenario for the African side of Egypt is return to the frequent terrorist attacks that plague Egypt in the 90's and return to the harsh crackdown against the Islamist.

The most likely scenario is that the current security problems will get worse but a negotiated deal will be reached between the parties involved.

<comment><USER3> Most interesting, and quite different from media portrayals here in the US. Thanks for the insight.

</comment></comment></comment></comment><comment><AUTHOR> She managed to hit her fundraising goal with 7 days to spare. Awesome.</comment>


The Lost Boys of California - <AUTHOR> http://vice.com/read/the-lost-boys-of-california-0000258-v21n3

<comment><USER2> Anyone other than me having trouble making the pop-over video ad go away?

<comment><AUTHOR> My apologies -- I posted this from mobile and didn't see the ad. I should have checked. If you're motivated, I found that deleting the div ids "jpintoverlay" and "jp_lightbox" worked for me.

ETA: Even better: prepend a "m." to the URL.</comment></comment>


Rails 3.0.20 and 2.3.16 have been released - <AUTHOR> http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/

<comment><USER2> As far as I can tell the latest Rails version (3.2.11) is not affected. Of course, I only noticed this after frantically updating my gems. Sigh.

<comment><USER3> Doesn't appear to affect 3.1.x or 3.2.x

</comment></comment><comment><USER4> Oh joy. We just patch the last bug in 2.3. My manager will not be happy.

<comment><USER5> Could be worse, you could have developed everything with Java applets.

</comment></comment><comment><USER6> Given we are still seeing more security issues with Rails, shouldn't the developers down tools for 5 mins to stop with the shiny-shiny, and maybe rewalk the codebase, the dependencies they set, and review things?

Yes, they are quick to band-aid the overall problem, and push out yet another version bump, but, no one other there seems to really grasp the nettle and admit too much auto, too much magic, too much opinionated design has meant a framework with more holes than swiss cheese. We have only just started to see the trickle of reported issues, before the flood.

Ironically, we had a call this morning from a customer that there rails app server has been compromised, despite diligently patching and updating.

I would rather see one better update to Rails for the release versions, arising from a proper audit, proactively closing the windows left from before, rather than shutting one each time it is reported.

<comment><USER4> > Given we are still seeing more security issues with Rails, shouldn't the > developers down tools for 5 mins to stop with the shiny-shiny, and maybe > rewalk the codebase, the dependencies they set, and review things?

This is what's been happening and why we have seen a ton of releases.

<comment><USER7> +1. Exactly. This is why so many of these bugs are coming up now. It is a very good thing.</comment></comment></comment>


Today is #stalkingstalkerday - <AUTHOR> https://twitter.com/search?q=%23Stalkingstalkerday&src=hash It started in Italy, let's make it international!
If you are – or have been – stalked, write about it on a blog, facebook, wherever you like best.
Know it. Name it. Stop it.
Stalkers use the internet and various technologies to better stalk.
Let's use them now to better stop stalkers. <comment><AUTHOR> To my best knowing it started in Italy, let's make it international!

If you are – or have been – stalked, write about it in a blog, facebook, twitter, wherever you like best.

Stalkers use the internet and various technologies to better stalk. Let's use them to better stop stalkers.

Know it. Name it. Stop it.</comment>


Visualize JavaScript run-time behavior with Theseus - <AUTHOR> http://alltom.com/pages/theseus/chi-2014/

<comment><AUTHOR> Also, TL;DR with pretty pictures on the project github repo: [https://github.com/adobe-research/theseus](https://github.com/adobe- research/theseus) (though the linked article gives a better overview of its purpose and context)</comment>


Ask HN: Finding good interns? - <AUTHOR>

Recently, I've been thinking a lot about how small software companies have trouble finding good interns. I was hoping some people could share their experiences looking for interns.<p>Two big questions: -How did you approach finding them? -Did you suffer from either a lack of applicants or did you receive lots of applications but not very many "qualified" ones<p>-thanks <comment><USER2> Interns are college students. College students can be kind of dumb about job searching... for the most part, they will tend to apply to the companies who come on campus, and ignore the companies that don't. Pick one or two campuses and go all out to recruit there and you'll find some. There are some colleges that have a particularly high concentration of good CS students: UIUC, Stanford, Rose Hulman, Waterloo, and MIT are all good bets.

For a whole BOOK about recruiting on campus:

[http://www.amazon.com/Recruit-Die-Business-Young- Talent/dp/1...](http://www.amazon.com/Recruit-Die-Business-Young- Talent/dp/1591841615)

<comment><USER3> Waterloo Co-op website: <http://www.cecs.uwaterloo.ca/employers/prospective/>

</comment></comment><comment><USER4> I'm a student, graduating this spring. Here are my thoughts:

For one, I might not have heard of your company. It's not a personal bias against small companies (and you haven't heard of me either :) But how do you make sure students are aware of your existence? A popular blog is one way. A job posting on a campus job board is another. You can also contact a secretary in the CS or EE department, and ask to have your job posting sent to the mailing list.

Also, don't ignore the colleges that aren't the usual suspects for a source of good CS students. I'm sure students at MIT or Waterloo see more job postings than students at my school. This just makes you lost in the noise. (and makes me personally wonder if I made a huge mistake when turning down that Waterloo offer of admission :)</comment>


Wolfram Language: Introducing knowledge-based programming - <AUTHOR> http://www.wolfram.com/language/

<comment><AUTHOR> I thought this was going to be vaporware, but man, I'm impressed. If it can really do half of what the introduction video shows, I'm can't wait to play with it!

One thing I think is particularly interesting is that the onboarding process lets you use natural language to figure out what WolframCode to write. Slick!

<comment><USER2> Have you used Mathematica before? Other than deployment capabilities everything in this demo was available in Mathematica for more than 4 years already.

This Wolfram Language is nothing else but smart PR.</comment></comment>


Orno\Di, a powerful and extremely fast dependency injection container - <AUTHOR> https://github.com/orno/di

<comment><USER2> thank you :)

<comment><AUTHOR> You're welcome, I'm currently working on an MVC routing layer that uses the container to resolve controllers and their dependencies, example restful api here [http://happyaccidents.me/blog/orno-skinny-series- building-a-...](http://happyaccidents.me/blog/orno-skinny-series-building-a- restful-api) and benchmarks of the container against other popular containers here [http://happyaccidents.me/blog/benchmarking-dependency- inject...](http://happyaccidents.me/blog/benchmarking-dependency-injection- containers)</comment></comment>


Nobel-Worthy "Seaweed with Musical Timing" - <AUTHOR> https://blog.kranzky.com/a-nobel-worthy-seaweed-with-musical-timing-96a0e12b0e99#.w4ypsma47 <comment><AUTHOR> This is obviously, I hope, all just a bit of fun.</comment>


Where to safely store your gold - <AUTHOR> https://www.nytimes.com/2020/07/28/style/gold-storage.html <comment><USER2> At home.

If you entrust __any __of your valuables to a third-party, they own them, not you. That applies whether that third-party is your neighbor, the local branch of your favorite bank, or some very prestigious international organisation. Once those things leave your personal control, you have no control at all.

Imagine how you would feel if somebody "As Safe as the Bank of England" happened to hang on to something of yours:

Venezuela files legal claim with Bank of England over gold -[https://www.bbc.com/news/world-latin- america-52733299](https://www.bbc.com/news/world-latin-america-52733299)</comment>


Building the Next New York Times Recommendation Engine - <AUTHOR> http://open.blogs.nytimes.com//2015/08/11/building-the-next-new-york-times-recommendation-engine/

<comment><USER2> I'm really impressed that NYT took the time to document this. It's always interesting to see the different recommendation models evaluated and applied to real-world situations.

I've been pursuing a collaborative filtering approach to product recommendation lately ('people who bought this also bought that'), but perhaps LDA would let me model our products based on their metadata ('people who bought products broadly like this also bought products broadly like that').

</comment><comment><USER3> We make a contextual recommendation engine as a service for online publishers at our startup ParallelDots. We discovered the problem of tags not really working well for recommendations on our clients websites too. We ended up using unsupervised word embeddings and auto encoders on top of them to solve the problem. We dont still use it for personalization though, just contextually similar articles. Great seeing some of similar problems being solved at New York Times too. :)

</comment><comment><USER4> The way I see it, the primary thing to solve for any recommendation engine is to optimize for serendipity. I.e. allowing you to get information you didn't know you wanted.

This means basically also finding ex. articles that are not written by NYT.

Newspapers problem is that their primarily omnibus approach to whats relevant isn't really doing the waste amount of insightful information available that exist out there.

So the whole issue IMO with all newspapers/media these days. They are building silos where none should really exist and this is one of the primary the reason why people don't consider it valuable anymore.

<comment><USER5> Maybe you had no idea but what you describe already exists in the form of native ads and recommendation widgets like outbrain. And here's what I do when I run into them: I rarely click them. When I'm on NYT, I don't want to click out to some "recommended" website that doesn't have high journalism integrity as NYT (Let's not get into a needless argument of whether that itself is correct or not). My point is, I disagree with your argument that "different source" has anything to do with serendipity. Also you say silo shouldn't exist but I don't see a reason why. Sure there are clearly cases where certain companies siloing up their user's data is bad for humanity, but in this case it doesn't even make sense (what even is "silo" in this context anyway?). People create silos because of demand. Imagine if NYT started opening up and let any random guy on the web write articles on their front page, what did they gain by "opening up" their silo? Most readers of NYT are there exactly because it's a silo that guarantees certain degree of quality. Once they start "opening up", you'll probably be the first to say "yeah New york times is done now, it's all low quality now"

<comment><USER4> I don't think we are talking about the same thing.

To get sense of where I am coming from i would like to refer to some of my writing on the subject.

[http://000fff.org/#/slaves-of-the-feed-this-is-not-the- realt...](http://000fff.org/#/slaves-of-the-feed-this-is-not-the-realtime- weve-been-looking-for)

and

[http://000fff.org/#/how-to-think-like-facebook-and- twitter](http://000fff.org/#/how-to-think-like-facebook-and-twitter)

It's about something slightly different than what you seem to imply, sorry if that was imprecise.

</comment></comment></comment><comment><USER6> Fun read. Topic modeling can be fascinating to work with.

Curious how they measured performance of their model, and whether they found a "best" number of topics for LDA where their model stopped getting much benefit by having more topics.

I'd imagine increased number of topics would have some interesting side effects where it would create too narrow of recommendations.

</comment><comment><USER7> We have built this and anybody can use it [https://Algorithmia.com/recommends](https://Algorithmia.com/recommends). 2 lines of js to implement.Currently serving the geekwire.com recs. You can also modify it further (see blog.Algorithmia.com).

The article is awesome though good on NYT.

<comment><USER8> Nice product you have there. Not only did it take 10 minutes to run, it also managed to return no results.

<comment><USER7> That should not be the case, sorry you had a not great experience. Please share the url you used at Diego at Algorithmia for com so we can debug and get back to you.

</comment></comment></comment><comment><USER9> I think it'd be great if you'd have this kind of information in your help section later on, for anxious people like me who are very wary of even having a recommendation engine at a news paper. I was actually on my way to sign up for a subscription after reading "A Renegade Trawler, Hunted for 10,000 Miles by Vigilantes" by Ian Urbina - but held back for the moment to give it more thought.

That said, I guess I could see a point in it maybe retaining users / subscribers if it's good enough. (I'd still appreciated it a lot more if this functionality could be turned off for users who request it though).

<comment><USER10> My first reaction to your comment is that you're overreacting and targeted news stories based in topics you enjoy is a great thing.

But after some thought on the recommendation engine, this seems more like a confirmation bias engine. Not something I'd want from a "news" source.

<comment><USER11> I'm not really how it would be confirmation bias. The NYT doesn't have multiple stories on the same topic with differing conclusions that it A/B tests with.

As the article states, it'll suggest articles about Hillary Clinton if you've read articles about her previously, but it doesn't say it'll only give you positive ones. There _is_ a chance that it'll narrow people's interests (if you only read sports, for example) but that already happens anyway.</comment></comment></comment>


Show HN: I am a CodePusher and I love it. Thanks MS and not M$ anymore - <AUTHOR> https://jsapp.me/i-am-a-codepusher-and-i-love-it-thanks-ms-and-not-m-anymore-7be936e86c75#.9jhkvudn7 <comment><USER2> > I have always been a firm believer of the open source movement and I stopped > using Micro$oft a.k.a. M$ products twenty years ago. I never agreed with the > monopolistic view that this company pursued for years without really > benefiting the customer at the end. Today my opinion about Microsoft a.k.a. > MS has changed.

If I had to judge the author basing on the post, i'd say it was one of those people willing to say "Micro$oft" just for the sake of it, in order to say "look at me, i'm different, i am a special snowflake that uses gnu/linux".

Well, Microsoft is playing a lot nicer towards open-source nowadays, mostly because it wants a large fraction to come from services and not from products anymore.

But keep in mind that Windows is still closed and proprietary and the same applies for Office and many more software products.

In particular, look at the "Terms of Service" page: ([https://msdn.microsoft.com/en-us/cc300389](https://msdn.microsoft.com/en- us/cc300389))

        Manner of use. You may not:
        1. reverse engineer, decompile, disassemble or work around technical limitations in the Services, except to the extent that applicable law permits it despite these limitations;disable, tamper with or otherwise attempt to circumvent any mechanism that limits your use of the Services;

        2. rent, lease, lend, resell, transfer, or sublicense any Services or portion thereof to or for third parties, except as explicitly permitted herein or in license terms that accompany any Services component;

        3. use the Services for any purpose that is unlawful or prohibited by this Agreement; or use the Services in any manner that could damage, disable, overburden, or impair any Microsoft service, or the network(s) connected to any Microsoft service, or interfere with any other party's use and enjoyment of any Services.

I mean, come on, reverse engineer, work around technical limitations, that is literally the base of free software and open source.

It's nice to say "I <3 open source" when you're not reading the license.

</comment><comment><USER3> How is it with ensuring packages reach phones unchanged? Can I sign my updates and have the updates verified before being applied?</comment>


The Argument Against Climate Change - <AUTHOR> https://medium.com/@richardeng/the-argument-against-climate-change-664db3a9ddfd <comment><USER2> My summary of the disgusting suggestion: "don't worry that millions of humans might die because the human species will live on and be amazing."

Me, I prefer a human species which is amazing and has empathy.

<comment><AUTHOR> Hmmm, apparently my attempt at sarcasm is going over the heads of my readers. Whoosh!

Perhaps I need to be less subtle...</comment></comment>


Italy's antitrust watchdog is investigating Google - <AUTHOR> http://tech.yahoo.com/news/nm/20090827/wr_nm/us_google_italy_antitrust <comment><USER2> yeah, good idea.

The Prime Minister here owns 3 tv channels and somehow more or less controls RAI's other 3 national channels, and they investigate Google...

<comment><USER3> Well, I think we all agree that google agregating your news should be opt-out, and the threats to stop search-engine-indexing site which doesn't allow its news to be on unrelated news-aggregator service is ridiculous.

So that ridiculousness is worth investigation, sure.

On other hand, I don't see why newspapers would object aggregating their articles into google news. Google news is all about links to the newspaper sites; it's a source of clicks, not a way to steal content.

<comment><AUTHOR> I'm also curious about why companies might want to opt out of the news aggregator.

Although I'm wondering why companies even have a say in it. Isn't the aggregation involved fair use? If I start my own news aggregator do I have to ask publishing companies permission? I feel like I should be able to just aggregate them whether they like it or not.</comment></comment></comment>