Need advice - <AUTHOR>

I need some serious advice. I'm a freshman in college right now and having some psychological/other issues. It's kind of complicated, so I don't really want to go into it. Part of it comes from being raised in a strict Asian family and pressure.
The thing is, I really can't take being in college anymore (mood swings, irrational fear, etc). I'm thinking about dropping out, even though my dad would almost disown me for it.
These psychological issues mostly arose from events in the past year, and aside from that I've been stable. I'm academically smart (2330 SAT, valedictorian) and I like programming. I've done well in my first-year math and CS classes at an Ivy school.
I'm wondering if dropping out would really ruin me like my parents say. I hope that I could drop out, pick myself back up, and build something from there. I'm a very hard worker and willing to freelance/open source/learn through books and online tutorials.
Edit: My fears aren't completely irrational, and they've been debilitating.
I just really need some advice and perspective here. Thanks. <comment><USER2> I mean this sincerely- you need professional help. Don't make any drastic decisions until you speak to someone that can help you.

Your school should have healthcare resources available to you at no cost- you should start there.

Just call them up and say you'd like to schedule an appointment with a therapist. You don't need to say why- that's between you and the therapist- there is NOTHING wrong with seeing a therapist- oftentimes just being able to air your problems to a confidential source can be very liberating.

Please do talk to a professional- you'll feel better, I swear!

<comment><USER3> Certainly agreed with the above.

It's really frustrating to have issues like that - while you can understand and control logical things, psychology and emotion are not totally logical and are often out of our control. I'm sure as a smart and logical guy and a programmer this is something that you can connect to and that has kind of driven you crazy if you have thought about it.

There's no reason to be embarrassed to seek help - I know a lot of people and good friends who have done it and it has helped them a lot. Don't let your smarts and awesome potential go to waste because of an issues like these : )

</comment></comment><comment><USER4> Based on the description you have provided, it sounds like you have psychological issues that need to be addressed. Before taking any action, I suggest you visit your campus health center. They typically offer free psychological counseling that may be able to help you address the underlying issues.

</comment><comment><USER5> My dad always said that you should make choices based on the thing you want to -do-, not the thing you want to get away from.

When he was in college he got tired of math so he switched to biology. Well, that wasnt fun either. Thus the observation. He stuck with biology, began to love it, and became a great biology professor.

Life is too short to be in a hurry. You can waste calendar years flip flopping around (ask me - I should know). Take your time, make decisions slowly, make changes when you're sure. And choose the -right- thing for you, don't make decisions based on what you want to get away from.

Good luck. You're a smart guy. Slow down. You'll find the right thing.

<comment><AUTHOR> I was planning to read a lot of source code, write a lot of code/contribute to open source, and study formal CS on my own. I think after 3-4 years I would have as much programming and formal knowledge as if I had stayed in college, and maybe more. I want to do this and would find it fun.

I'm wondering if the lack of a degree would hold me back significantly. That seems to be my parent's main worry.

<comment><USER5> Having a degree from an Ivy school will help you as compared to an ordinary degree. I went to a middle of the road state school and I have seen first hand that many "people who matter" are materially predisposed towards favoring those with degrees from fancy schools. Some could argue it's rational. I'm talking about employers, investors, and even in regards to dating.

If you leave school you are likely to find work without too much trouble, but you'll be somewhat worse off than a guy with a degree from a middle of the road school. Outside of silicon valley a college dropout may face a greater headwind than inside silicon valley.

If you can become the next Mark Zuckerberg or Bill Gates, it won't count against you at all. Notice that they both left school for a very good specific opportunity.

The best thing about graduating from a great school is the relationships you'll build with other smart guys. I'm not sure why, but most lifelong friendships seem to be formed in school. Learning alongside those smart guys is also highly motivating.

Finally - if you leave school to get away from your parents pressure, you're letting their actions control your life. You are an adult now. Take charge. Don't let rebelliousness push you around. Choose carefully, realizing that a degree from a top school is a good opportunity.

</comment></comment></comment><comment><AUTHOR> This is kind of a fear related to financial aid. It's mostly irrational, but not completely so. And the little part that's not irrational has been bothering me a lot.

Thanks for the advice about the psychological help. I'll think about talking to a therapist. Apart from that, how serious would dropping out be? Just from an economical/career perspective..

<comment><USER6> Here's the thing, most people out of college can't code in a way that is meaningful for entry level at a tech firm. You seem to have the aptitude to get there on your own, but lack the experience / knowledge-base to convince most companies that you are worth the 3-6 months that are required to teach you what you need to know. After all, they can always grab someone from the graduating class of a top school, that has your smarts and more formal education.

I can't tell you how many MS candidate resumes I've read (CS), where they've done tons of projects, but there code sucks. That doesn't mean they aren't really smart and won't be great in a few years, but not now. 400 line functions (poor OOP), poor commenting, inconsistent naming conventions, poor memory allocation...the list goes on.

Figure out your issues and work on them. I understand the debt concern, but your expected value of success and future earnings will be severely limited. Hope for the best and prepare for the worst.

<comment><AUTHOR> I don't expect to get a job after dropping out. My parents will let me live with them at least. So I have a good 3-4 years.

I was planning to read a lot of source code, write a lot of code/contribute to open source, and study formal CS on my own. I think after 3-4 years I would have as much programming and formal knowledge as if I had stayed in college, and maybe more.

I'm wondering if the lack of a degree would hold me back significantly.

<comment><USER7> It doesn't. And remember, you can always go back and finish. Maybe not at the same place, but you can finish somewhere. I would suggest ending the semester though, not dropping out in the middle. You get credit for the current semester this way and you won't have to pay for it again hopefully.

</comment></comment></comment></comment><comment><USER6> Please seek help of a trusted professional. You have taken a great step in identifying the issue; now be brave and seek the help you need.

Whatever issue you are facing in college will surely come about again in life. Trust me on this, college is still very much NOT the real world.

Best of luck and there is no shame in getting psychological help.

</comment><comment><USER8> First, seriously, go see a therapist before you make any decisions. The fact that this is happening during your freshman year is disgustingly normal - everybody goes through a period of adjustment at this point in their lives, but it's _much_ harder for some (particularly kids who have parents with big expectations).

Second, you'll survive and probably do just fine if you drop out and self- study. Having said that, an ivy league education opens doors. I dropped out my senior year. I'm doing fine financially, but I'm certain that I could have done much more interesting things if I'd stuck it out.

Remember, your education is for _you_.

<comment><AUTHOR> Thanks for the advice. I'll probably go see a therapist.

Since you dropped out your senior year, did you already have significant internship experience and contacts by then? Did that help you succeed?

<comment><USER8> No, and I didn't even do anything in my field of study. I feel like I've done well despite the lack of paper, but as the years have worn on, my reasons for dropping out sound less and less credible and more and more like excuses. It's definitely a hindrance in interviews.

You may also want to consider the possibility of transferring to another school rather than dropping out.

</comment></comment></comment><comment><USER9> Many serious psychological issues manifest in the late teens and early twenties. I was in an honors program in college, and I saw several students develop psychological disorders of varying degrees - it may not be because you are in college that you're having these issues. Schizophrenia and schizo- effective disorders , specifically, are known to develop in this age range.

</comment><comment><USER10> This is a health issue, just like any other.

Seek help on your campus or in the community or your family.

Don't make assumptions about your parents' reaction. Again it is a health issue, and your parents may be your best resource.

</comment><comment><USER11> there was an article today linking gut health with mental health, check it out: [http://articles.mercola.com/sites/articles/archive/2012/03/1...](http://articles.mercola.com/sites/articles/archive/2012/03/18/mcbride- and-barringer-interview.aspx)

Also, drop me a line if you want to work on a site I'm building (Django) .. could be useful for you.

</comment><comment><USER11> Maybe take a half-load of subjects and spend the rest of the time focused on what you enjoy.

</comment><comment><USER12> Yeah, definitely schedule an appointment with a counselor to talk it out

</comment><comment><USER13> I think that applying to some real work places and test their reactions would do you good. If they are happy to take you onboard - cool, dropping out wouldn't be that painful. Sign up the contract before you leave Uni, softening the shock for your parents (Mom, dad, I quit Harvard BUT started working at Facebook). If, on the other hand, you find it hard to pass interviews - cool, your place for the next few years is in Uni, where you will gain some important knowledge and connections (but do try to have fun - after all, that's what really matters).

Most of us have been there - one way or another. You are not special or different in that sense. Life's hard (harder for some) and you might be needing some professional helping hand now and than (yes, some of us have been there - too), but ultimately - it's doable, even if there are times were all you can see is darkness.

As the great Leonard Cohen have said: I greet you from the other side, Of sorrow and despair. With a love so vast and shattered, It will reach you everywhere

<http://www.youtube.com/watch?v=J0KnDCVEcp8>

Good luck !

<comment><AUTHOR> Thanks for the advice. I'm not someone who's been programming for years.

I just took multivariable calc and intro CS (scheme) this semester. I'm wondering whether self-teaching is realistic, and whether employers consider self-taught programmers.

I can get access to books on CS/MIT online courses/Stanford online courses and study CS. And there's a lot of source code I can read and learn from. Is this do-able?

<comment><USER13> Doable ? sure, but not relevant. Can YOU do it ? that's a question only you can answer.

Other than that, programming is a craftsmanship. Like any other one, it might take a few years to master it. A couple of courses in Uni is definitely NOT what makes you a programmer (or developer or an engineer or whatever)...</comment></comment></comment>


Former Card Counter's New Start-Up Helps Measure Productivity - <AUTHOR> http://bits.blogs.nytimes.com/2012/06/07/former-card-counters-new-start-up-helps-count-productivity/?src=rechp

<comment><USER2> All of these metrics are terrible for tracking productivity. Each one can be gamed and would become inversely correlated with productivity if there was any incentive to maximise them.</comment>


Is Stanford's network traffic being routed through japan? - <AUTHOR>

I'm on Stanford's network, and when using any of my machines, amazon asks me if I'm shopping from japan, and offers me the .co.jp version of their website.
I've tried different browsers, different machines and finally I tried using LTE, and got the regular amazon, without the option to switch to amazon.co.jp.
Should I be worried that my traffic is being routed through japan/is there an easy way to test for that? (I'm not actually worried about routing - routing would keep my ipaddress the same, and not give me this issue. I'm worried that something nefarious is going on, and I'm not clear on what I should call it, other than routing.)
As far as I can see, the only other alternative is that amazon thinks Stanford's ipaddress block is in japan. <comment><USER2> [https://en.wikipedia.org/wiki/Traceroute](https://en.wikipedia.org/wiki/Traceroute)</comment>


Ask HN: Best ways to learn new stuff? - <AUTHOR>

Especially on limited time?  Some people are lucky that they can learn at work, but most corporate type jobs don't teach much.  So how do you learn new things, when you have limited time outside work?  Also, how do you decide what to learn? <comment><USER2> Josh Kaufman have recently released a new book called "The First 20 Hours -How to learn anything" -which is an awesome, operational description of rapid skill acquisition.

The better question is: "How do you decide what to learn?" -for which I strongly suggest taking a strategic portfolio approach: have a few skills that you know in depth, and maintain a consistent flow of learning new things on at least a surface / API level so that given the opportunity you can reach out for them.

Having a few of these under your bells will open your eyes to new opportunities both within your job, and in your life that you can pitch / take advantage of; at which point you can tie it into the "things people pay me for", and start the journey of mastering it in depth without any danger to your livelihood.

</comment><comment><USER3> I honestly don't recall where I read this, but one thing that really struck me is "Work 60 hours a week. 40 hours a week for your company, 20 hours a week for yourself"

I find it true. As you say, company work don't teach much. Better said maybe, they don't teach much diverse skills. Most of your time is spent doing CRUD or API modifications.

When I get out of work, I try to get projects about things I don't know anything about. Like learning web dev (or at least trying), publishing an android app, or even teaching yourself marketing.

For me, the rule is usually simple : \- Do something you don't know anything about. \- Make it small. \- Do it fast enough so that you don't get bored. \- Publish it.

I like it because I usually struggle a lot, and then understand the rough concepts. Adn the next project is easier, because I am used to trying to understand how stuff works. It basically keep your brains agile.

And the best thing is that it makes you better at your job. Because you can then think out of the box, and offer new solutions to problems. More than if you'd spend 60 hours a week on your job only.

Last thing is, those small projects, you can show them off; which makes you more seducing for other companies / people. Simply because you can talk about them, without having to know too much context :).

</comment><comment><USER4> Working for a smaller company will normally give you a far wider scope of technologies due to how many staff they have, this isn't always a positive however, but it can certainly be more interesting.

Working in a larger company normally will have the other benefit that you become an 'expert' within your field much more easily, because your silo'ed working on that one thing most of the time, however make sure you enjoy that one area your working in!

Out side of work just try dedicated some time each day, say an hour or even just 30min, read some material or try build something a little bit more each day. Once you have a plan stick to it and look back at the end of each week to see if your actually learning anything, if not amend your plan to suit.

Picking what to learn when you have limited time is going to be fairly difficult, your probably going to want something that you already have an head start on so you can make decent progress with your limited learning time. For example if you know Cisco routers, learn Juniper routers. If you know PHP learn MySQL, Memcache etc...

</comment><comment><USER5> I've been in a funk for quite a long time now. I think the most important thing is to establish a vision for your life. What do you want your life to be about? It's a question that might take some time to answer. You could always randomly pick a popular subject to learn (economics, web dev...). But the question you'll have to ask yourself is why do I want to learn one thing over another. Time is the most precious thing you have, and so it's good to have a direction in your life, so that, what do you do is gradually guiding you in that direction. On the other hand, sometimes you could take that analysis to the extreme (called analysis paralysis) and never decide what you want to do. In that case, just pick something that's interesting and _stick with it_ for an extended period. This is something that most of struggle with. There is so much to do, you can flip-flop between activities, never really getting much depth. Good luck, it's a long journey, but you're already asking the right questions.

</comment><comment><USER6> I just attempt to remain passionately curious. If I don't know something I read about it on Wikipedia, if it still doesn't make sense I search Amazon and order a book. I've learned things about Sociology, Politics, Corporate Finance, Theoretical Computer Science and Parkour this way. We live in a really interesting world, try to understand how everything you come in contact with works (on some level).

</comment><comment><USER7> Maybe the easy answer is, find a job where you can work on what you want to work on? Whether that's for a company, or for yourself, life's too short.</comment>


Windows 10: Here are the privacy issues you should know about - <AUTHOR> http://thenextweb.com/microsoft/2015/07/29/wind-nos/

<comment><USER2> Most of this is to be expected, but the parts that are ridiculous is that your encryption key is backed up to OneDrive and:

 _" We will access, disclose and preserve personal data, including your content (such as the content of your emails, other private communications or files in private folders), when we have a good faith belief that doing so is necessary to protect our customers or enforce the terms governing the use of the services."_

<comment><USER3> It seems that Microsoft had removed this sentence from their Privacy Statement - at least I'm unable to find the quoted text now.</comment></comment>


File Transfer app for android - <AUTHOR> https://play.google.com/store/apps/details?id=com.dinero.mesh

<comment><AUTHOR> The ultimate, quick file sharing application that will simplify your life. No use of your data plan, faster than Bluetooth, no cables, and you don't need cell phone service! Transfer between all platforms at lightning speed!</comment>


Groupon tries to recruit DHH. - <AUTHOR> https://gist.github.com/1285068 <comment><USER2> I think jrmehle had the best response:

      Recruiter: How many years of Rails experience do you have?

      DHH: ALL OF THEM

<comment><USER3> Haha I feel like recruiters do no research about the people they try to contact. Same thing keeps happening to @wycats.

<comment><USER4> At my previous gig, I had recruiters from MY OWN COMPANY contact me with "opportunities". I moved on shortly after that.

<comment><USER5> Should have taken the job; might have gotten a raise!

<comment><USER6> That would have been an interesting two-week-notice to give.

</comment></comment></comment></comment></comment><comment><USER7> The best meme: "I don't always hire Rails devs, but when I do, I hire the creator" LOL! <https://gist.github.com/1285068#gistcomment-56381>

</comment><comment><USER8> In my experience, these recruiters just grep for words like "Ruby" and "Javascript" and blindly send out form letters.

I will say though, when I was looking for a job, a recruiter helped me set up quite a few interviews in a short period, and I ended up being placed somewhere awesome.

<comment><USER9> I've had pretty poor luck with folks who do out-sourced recruiting, but I recently got headhunted by an in-house recruiter and ended up taking the job and loving it.</comment></comment>


Opensource Backend as a Servicce: BaaSBox  - <AUTHOR> http://www.baasbox.com/

<comment><USER2> How is this open source,because i can use the sdk ?

Is this based on docker?

<comment><USER3> Here is their github repo - [https://github.com/baasbox/baasbox](https://github.com/baasbox/baasbox)</comment></comment>


Why I Don't Watch the News - <AUTHOR> http://bennesvig.com/2011/11/04/why-i-dont-watch-the-news/

<comment><USER2> I saw a crap website once, I'm giving up on the web.</comment>


Elon Musk says lost multi-billion-$ contract when SpaceX didn't hire official - <AUTHOR> http://qz.com/212876/elon-musk-says-he-lost-a-multi-billion-dollar-contract-when-spacex-didnt-hire-a-public-official/

<comment><USER2> Despicable if true. That official picked the wrong guy to get in a fight with.</comment>


43M passwords hacked in Last.fm breach - <AUTHOR> https://techcrunch.com/2016/09/01/43-million-passwords-hacked-in-last-fm-breach/ <comment><USER2> Regular reminder that new users in general don't care at all about the security of your site.

Most of your signups are not going to generate and store a secure password "just to try you out", as evidenced by the most common password here "123456". If you force people to signup to try your site/app, many (most?) of them are going to use a crap password. If you're _lucky_ that'll be 123456, and not their email/facebook/internet-banking password.

The answer isn't to try and force "good passwords" from users who don't care. Remember, by definition - they don't care.

We need to start trying to not require users to come up with passwords until they do care. Maybe just cookie me and let me tromp around as an unauthenticated user until I do something that needs me to set up a password- protected account. Maybe ask for my email and send me a login link that hooks me into my account/data without me setting a password (lets face it, your password security is going to fundamentally rely on the security of my email account, 'cause your "forgot password" story says you'll happily send a password rest link there, right?

I know Start-up-de-jour desperately needs "signed up user numbers" for their investor pitch, but that's not going to motivate me to stop using 123456 or password123 as a password when startupdejour.io demands I create an account just to look around.

<comment><USER3> Emailing a single-use "sign in link" to a user (Slack calls these "Magic Links") is the way forward. Yes, it move the single point of failure to the user's email account, but expecting the regular user to use (and remember) unique passwords for each service is impossible -- they simply won't do it. Plus, when/if your service is breached, you won't compromise all their other accounts as well.

<comment><USER4> It's really a shame that we haven't solved this problem yet as an industry.

I was thinking we could build a general purpose version of "Magic Links" for logging in, where the format of the email is well-defined, and the user's browser is able to receive these messages on their behalf through some form of integration. You could imagine a webmail provider offering some kind of polling or websocket API for listening for when these messages arrive.

When the site they're visiting indicates through its web page that, "I'm trying to authenticate you by email", then the browser can fetch recent incoming messages of this type, then parse them and display UI chrome like "Xyz.example.com wants to authenticate you". You click a button to log in passwordlessly, which involves sending an HTTP request to a link specified in the email. Coordination occurs on the server side and the login is allowed.

There are probably some details I'm not considering, but it doesn't seem like it'd be too hard to build a prototype, and if standardized and deployed it would eliminate the need for passwords. I gather that Mozilla Persona works along similar lines, though I confess to not knowing the exact details. There would be practical difficulties integrating all of these things together, though: email, browser, and website login, and gaining adoption in the real world.

There are also sites that don't require email on signup, but this feature could be supported only for people who want to supply email. The email address used for this feature could also be a different technical address unrelated to the primary mailbox, where only login requests are sent. This could also help expedite the email traffic to ensure it's real-time. The browser could automatically fill in the email address when challenged by a website supporting this login method.

Alternatively, perhaps a browser vendor could introduce a de facto standard where sites can integrate via an API with the browser's password safe features. Chrome can save passwords and synchronize them across devices. Maybe it wouldn't be too hard for sites to comply with a microformat that helps the browser understand when to generate a password on signup, and when to provide it, etc.

<comment><USER5> You seem obsessed with one implementation. Passwords themselves are obsolete.

Actually the problem is already solved for at least a decade: Certificate based authentication. Browsers support it. Try StartSSl registration, for example.

<comment><USER2> Yeah - but that's like saying "email security and integrity has been solved for two decades", while _technically_ true, how many of you have talked your mom through setting up PGP and had her then "just use it"? (or tried to handhold a less-than-technical colleague through getting a StartSSL account?)

I'm pretty sure if any service less-technical than a CA authority starts pushing wide-spread user-driven in-browser certificate-based authentication, within days there'll be scammers and phishers faking the setup process to install untrustworthy ssl root certs so they can mitm Paypal/Facebook/everybody... How would _you_ explain to your mom the difference between installing Pinterest's new authentication certificate, and installing, say, the Charles Proxy ssl MITM cert?

<comment><USER6> > How would _you_ explain to your mom the difference between installing > Pinterest's new authentication certificate

Actually, even with current terrible UIs, there's a reasonably big difference between installing client certificate (there even used to be a <keygen> HTML tag for those - although it's unsurprisingly marked as "deprecated" now) and trusted CAs.

</comment></comment></comment></comment></comment></comment><comment><USER7> I would like to see websites make password changing a simple and standardized API call. That way integration with things like 1password will allow it to automatically change the password with each login. Or I can schedule them all to be updated every day, etc.

This drastically reduces the amount of valid logins from a dump that's even just a few days old.

2factor is simply not enough (though I still want it for important logins). Automatic password changing would be complimentary.

<comment><USER8> >I would like to see websites make password changing a simple and standardized API call. That way integration with things like 1password will allow it to automatically change the password with each login.

There isn't really a need for a standardized API it would make things easier but if 1password wanted it's not a very hard thing to do without it.

All you need is to do an HTTP request to change the password most sites allow that to be done in a single request, CSRF might be an issue but non single action forms are usually not protected or there is no need for that and there are ways to bypass CSRF also.

For a company like 1password it wouldn't be hard to build a request profile for say Alexa 500/1000 and automatically change the passwords once a breach hits, I have a similar setup of several scripts that update the password for various services I have by generating a random password in Keepass getting the old password sending the password request post and updating the Keepass entry.

<comment><USER9> LastPass does this. I actually used it about a year ago to automatically change the passwords on about three dozen sites. It failed on two pages that had recently been updated. It's a very useful feature though.

</comment></comment></comment><comment><AUTHOR> _> The number of passwords and the severity of the hack was not uncovered until today. The passwords were stored using unsalted MD5 hashing_

Enough said.

 _> The most popular password pulled from the Last.fm database was 123456. Seriously, it's 2016 people_

Sure, but the breach was in 2012 TechCrunch. Better article: [http://www.leakedsource.com/blog/lastfm](http://www.leakedsource.com/blog/lastfm)

<comment><USER10> Also the bulk of the users signed before that date. [0] Last.fm is one of my favorite sites. Sad that is dying :(

0\. rough heuristic: [https://www.google.com/trends/explore?date=all&q=last.fm](https://www.google.com/trends/explore?date=all&q=last.fm)

Edit: If anyone wants to add me on last.fm here is my profile! [http://www.last.fm/user/joer14](http://www.last.fm/user/joer14)

<comment><USER11> Wow! They had some great growth going on and it seemed to hit a wall hard around 2008-2009. Any idea why?

<comment><USER12> Easy. CBS bought them late 2007. Dev and updates pretty much stopped. They limited tracks you could play directly.

Then they killed radio.

I'm really sad to see it die, it was better at introducing me to new artists than any other service before or since, and the radio was brilliant.

<comment><USER13> Oh you must have left awhile ago then. I agree they ruined the best music discovery service on the web, but even without it the site was dated but functional.. until last year.

Last year CBS decided the whippersnappers needed a redesign and took out around 80% of the features and put the site into a perpetual beta state.

<comment><USER12> Didn't really give up until they had the fabulous idea to replace direct streaming with playing poor match Youtube videos as radio. That killed radio finally and made a none functioning joke of the main reason I bought my network music player.

Was mad about that as Last radio was my first choice for work listening.

The site was dated as they were frozen in 2008 - After CBS bought them there was one update very soon after then the site didn't change at all until last year. Minor updates and bug fixes only.

As for the update last year, pretty and vacant, doesn't bring back the things I loved about the site, but lets me see lots of pretty graphs of things I'm not interested in. I took a look at libre fm after that, but that's even more abandoned.

</comment></comment></comment></comment></comment></comment><comment><USER14> >Hashing is a method for encrypting data

No it isn't.

> MD5 is seriously out of style

That's, err, one way of putting it.

> The most popular password pulled from the Last.fm database was 123456. L > Seriously, it's 2016 people

These accounts were made more than four years ago...

> use a platform like LastPass

Yeah about that... [https://news.ycombinator.com/item?id=9721212](https://news.ycombinator.com/item?id=9721212)

Poor reporting is poor. Why do I expect more from TechCrunch?

<comment><USER15> Md5crypt Password scrambler is no longer considered safe by author: [http://phk.freebsd.dk/sagas/md5crypt_eol.html](http://phk.freebsd.dk/sagas/md5crypt_eol.html)

Also a better way to explain hashing algorithms to the lay person is to call them fingerprinting algorithms.

</comment></comment><comment><USER16> > it's 2016 people — use a platform like LastPass to generate randomized, > complex passwords that are unique to every service for which you sign up.

Another way to read this statement is that passwords simply doesn't work. We need something different. Something better.

And from the comments we find this:

> I am a bit confused. The article states that this happened in 2012, why is > it posted today? Something happened in relation to this breach?

I think this also needs much better clarification. What has happened since 2012 which makes this newsworth now? And where is the LeakedSource report they cite but never link to? Where can I get more info?

This is very bad reporting.

<comment><USER17> > The number of passwords and the severity of the hack were not uncovered > until today. The passwords were stored using unsalted MD5 hashing.

</comment></comment><comment> brian-armstrong 123456 is actually a /fantastic/ password if you don't care what happens to the account. If you aren't going to the trouble of using a password manager, and the account doesn't mean much to you, then using weak passwords like this rather than your "good" password is a great idea. Save the entropy for your email and bank accounts.

<comment><USER18> I see your point, but 123456 is still a stupid password. A brain-dead password scheme like "1 <NameOfMyCat> <Domain>" (e.g., "1 Snuggles last.fm") is just as easy to remember, won't show up in rainbow tables, is nominally difficult to brute force, and you're more likely to be able to use it, as opposed to '123456', which many sites will balk at.

(To be clear: I am not endorsing this scheme. It is superior to '123456', but it is still bone-headed.)

<comment><USER19> The point is that you should only use this kind of password in places where you _really_ do not care about someone else getting access.

It doesn't really matter what it is. It matters that it's something you're not for a moment tempted to think of as a "real" password and that you would never dream of using for any account where a data leak would affect you, but merely as a "they're stupidly asking me for a password for an account I don't care about, so lets just give them this" token.

I'd lean towards agreeing with you that it's better to pick something else, but only to slightly reduce the inconvenience of someone messing with your account "just because".

</comment></comment></comment><comment><USER20> Speaking of Last.fm, I really wish the thing had app-specific passwords as an option. I've been shuffling between Linux music players as of late, with Scrobbling as one of my requirements. Most of them have just required a login and pass instead of using OAuth. It would be nice if last.fm let me authorize them on an app-by-app basis.

</comment><comment><USER21> Man, I'm getting desensitized to the enormous numbers of accounts whose information gets leaked when a platform gets hacked. 43 million here, 68 million there. I'm semi-joking, but at this point it's almost like I need Facebook or Google level hacks (multiple hundred millions or billions) to actually think, "This is _huge_."

<comment><USER22> I've been thinking that for a while, but also how come it's never me? I've had accounts with several hacked systems and sure I try to have pretty strong passwords but... I appear to be safe every time.

Famous last words maybe, but then I'll just change my password?

<comment><USER21> You may appear safe but you never know... Services like Google and Facebook are pretty proactive about making sure unknown users can't access your account easily -- meaning that if someone from Thailand tried to access your account when you usually use it in the US from an unknown device, it'll generally not allow the login. But other services aren't as proactive and may be compromised, so it's definitely better to be safe. The best way is to use unique passwords for every service (or use OAuth with a service provider you trust), and a simple way to do that is with a password manager.

I personally recommend 1password, because they haven't had vulnerability issues like LastPass and don't store passwords in their cloud, but they store it in "your" cloud, e.g. iCloud, Dropbox, and it works very well on iPhone. But at the minimum just using a separate password for everything is the best way to mitigate these kinds of issues.

<comment><USER23> 1Password is moving to its own cloud service … although you can still use the traditional app with third party syncing for now.

<comment><USER21> Really? That's one of the main reasons I chose 1Password... Here's to hoping they keep both ways to sync!

</comment></comment></comment></comment></comment><comment><USER24> It looks like our current approach isn't working. What if we had each site publish its login/registration endpoints in a URL, e.g. .well-known/loginurls?

Then the password manager could detect you're trying to register or log in and log you in itself, generating your password in the process. Why aren't logins machine-accessible yet?

<comment><USER8> Password managers already do that, they just check for password type field and the site.

Keepass does that pretty sure all the others also do.

But again what problem are you trying to solve? using password managers is easy as pie today including automating signup and generating passwords, most people do not use them.

<comment><USER25> I started using LastPass just the other day because the recent news made me nervous.

It's NOT easy. The interfaces are clunky. I have to pay to get some basic features like browser plugin. There's a lot of false positives (it suggests me sometimes to save a password even if the field is not for passwords.) Generating secure passwords is hard because some sites validate length and charset only serverside and the poor manager has the invalid password already saved. Some sites play tricks to discourage pasting passwords. More than once I was unable to log in LastPass's online vault because of an "temporary error".

All in all, it was horrible, ergonomy-wise. I don't wonder at all why people aren't using them.

<comment><USER26> I'm using lastpass and I haven't had to pay for the browser plugin.

I've been using lastpass for the past year or so, and I've had no real issues with it ergonomics-wise. I can't even think of any sites off the top of my head that have given false positives.

It does seem painfully slow and unresponsive sometimes though, which isn't ideal. It's slow enough to disrupt my flow more than just typing in the same password for every website.

<comment><USER25> I could use the plugin for a trial period, but now it says that I have to be a premium member? Maybe it's because I also installed the app to my smartphone, thus my smartphone become the one device I can use the free version with?

<comment> nommm-nommm Opposite. You can use the browser for free. Mobile costs money.

</comment></comment></comment></comment></comment></comment><comment><USER27> It would be nice if the EU would do something useful like require all sites to hash salted passwords and prohibit the use of weak hashes for new accounts. Instead we get the ridiculous cookie nag.

<comment><USER28> Being European and computer literate, I hope the EU stops creating stupid and pointless internet laws

<comment> angry-hacker Another vote from a fellow European to keep Brussel bureaucrats out of internet.

They have no clue or somehow good intentions always turn our horrible.

An old saying about countries that can't get together a government (like ironically Belgium!) - - it's the best for the people for having a country without the government because then they can't make more stupid laws.

</comment></comment></comment><comment><USER29> The tragicomic part is how they enforcing password complexity:

Your password is not strong enough. New passwords must: Be at least six characters long Contain one or more numbers Include at least one of the following special characters: !"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~, or a space

So password efZeLmur3ivio4t7 is not safe enough to be used by last.fm and they use md5 without salt to protect it?

<comment><USER30> A password that follows that "security scheme" is _pass1!_ , which KeePass 2 reports as having a quality of 18 bits. _efZeLmur3ivio4t7_ , an illegal password, has a quality of 86 bits. Whoever was responsible for that decision should be fired. Either implement a _real_ password strength algorithm based on entropy, or don't implement any except maybe minimum length.

<comment><USER29> not just fired, but shot dead :-)

</comment></comment></comment><comment><USER31> Yes, we could argue that user should use more secure password, but on the other hand, I always wonder why startups these days are still busy rolling out their own custom account management than leveraging OAuth or hosted solution like Auth0. Seriously, in how many cases do we have a feature that is so unique that is not available via these alternative solutions?

Even though I have 1password setup, I would be so reluctant to create new passwords, I'm more willing to use OAuth whenever I can.

</comment><comment><USER32> Recommending a closed source cloud service to send all your passwords to in a thread on HN about a closed source cloud service that lost all passwords is a great way to demonstrate deep and fundamental knowledge about the principles of software security!

</comment><comment><USER33> > The passwords were stored using unsalted MD5 hashing

Ouch.

I guess on the bright side it won't be long before researchers have a new dataset of plaintext passwords.

</comment><comment><USER34> I spent 3 days off work a few weeks ago watching the Dota International and spent the whole time searching through my emails for 'account', 'registration', etc. trying to find everything I'd ever signed up to and finally move it all to a password manager because I really knew better and was lazy for the past several years. It took 3 days of like 6 hours a day half doing this to update all that I could think of and find. That ended up being about 150 passwords in total.

Even still, I missed last.fm and probably a whole host of other ones that I'll never remember. Passwords are a goddamn nightmare.

</comment><comment><USER35> Please get rid of passwords. Thanks.

<comment><USER2> I don't know who's downvoting you - but this is a really important idea.

As a new curious user of your new startup's website, I don't give a damn about being "secure". I've probably given you a fake name and a stupid password just so I can poke around and see if your site sucks any less than the other 5 or 6 new sites desperately craving my attention this morning.

If I can get in and look around without having to lie about my personal details - you're _way_ more likely to get a"proper password" and my real contact details if/when I decide I'm actually gonna add you the the list of "stuff I use" instead of "crap I signed up for once and never went back again" or "site I used a few times but none of my friends signed up so I stopped going there".

<comment><USER36> Probably getting downvoted because these comments are common and don't make any suggestions on how to get rid of passwords.

</comment></comment></comment><comment><USER37> Question about password best practices. Our site just went through pen testing, as part of auditing for PCI compliance.

One thing we got dinged on was that we don't keep a password history, so that the user can't revert to their previous password. The tester's report said, "This, in turn, results in users utilizing a single password for a long period of time, which may result in password disclosure"

It seems to me that this is the opposite of the truth. If I'm keeping a password history, then in the event of a breach, there is that much more data that would leaking, potentially disclosing password data if we made a mistake in the rest of how we handle it (hashing, etc.). And while I'm not a crypto expert at all, it seems to me that if there's a list of salted, hashed passwords, then given that the salt is a constant per user, an attacker would have some leg up in discovering the original password if there were many samples that included the same salt.

If I want to minimize the data I can disclose about users, I ought to minimize the amount of data that I'm storing about them.

<comment><USER38> It is a risk trade-off: letting the user reuse passwords used in the last X months is seen as less risky than storing the last 12 passwords (assuming the user is made to cycle their password monthly) _if_ you are storing the credentials securely (if anything is plain or reversible, you need to fix that ASAP).

Having 12 strongly salted+hashed password strings is not going to help an attacker much compared to having 1, even if you use the same salt (though I've not doe the maths myself, you'll need to ask a cryto expert for actual risk figures).

You could of course use a different salt per stored password instead of per user, to mitigate this completely.

Remember that password reuse risk flows both ways: if they reuse the password in your application and your application is well written with regard to securely storing credentials, they may be reusing the same password in another application that is less secure so you are more at the mercy of the password data from elsewhere that is storing things plain.

</comment></comment><comment><USER39> This is practically a startup, a service that just monitors and automatically updates your passwords as they get leaked over time.

<comment><USER40> 1Password has a feature called Watchtower that can tell you if your password for each site is vulnerable.

<comment><USER41> Unfortunately it triggers any site that it doesn't explicitly know wasn't affected by heartbleed, which makes it trigger that vast majority of my passwords. This renders it more or less useless :(

</comment></comment></comment><comment><USER42> Maybe now I can get access to my account. I forgot my password and tried to jump through their hoops to reaccess my account. They involved calling the support department during business hours. It was the holiday season, so I just gave up.

</comment><comment><USER43> We've had zero knowledge password authentication protocols for 20 years. At this point, any pain and suffering from these leaks is blood on the hands of browser vendors and web standards bodies.

</comment><comment><USER44> Hmm, I used to use last.fm, better change my password. Hmm, 1Password shows I was using a generated unique password, so that's good, though it wasn't as long and complicated as the ones I use now. And this password was generated June 7, 2012. Wait, when was the hack again? March 22, 2012.

Ah, looks like I was covered. But hey, now it's an even longer password with even higher entropy, so that's not a bad thing.

</comment><comment><USER45> 2012 was a good year. Fine vintage passwords.

</comment><comment> guard-of-terra New passwords must:

        Be at least six characters long
        Contain one or more numbers
        Include at least one of the following special characters: !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~, or a space

There's no way I'll remember a last.fm password like that! :(

<comment><USER46> Password managers are a must these days.

<comment> guard-of-terra I have several devices and enjoy being sometimes login on stray device I don't own.

</comment></comment></comment><comment><USER47> Is it really that difficult to upgrade all passwords with something like bcrypt(original md5)?

<comment><USER48> It's not that it's difficult; it's not a good idea. It does not increase randomness (entropy), and would probably decrease it. In that situation, update the hash with a new method upon login.

</comment></comment><comment><USER49> On that note I was just reminded that I could delete my account since I am not using it anyways anymore.

Apparently they removed that option very recently and now you can only 'close' it, which hides it but doesn't ever deletes it. :/

</comment><comment><USER50> Is there a reason to have a password other than 123456 on last.fm?

</comment><comment><USER51> Wow it's 2016 and Last.fm still isn't on HTTPS for anything other then login. And the "new frontend" is in beta for around a year IIRC...

</comment><comment><USER52> shit, my musical taste laid bare for all to see, better start packing...

</comment><comment><USER53> can someone please make a startup that upgrades unsalted md5 passwords to something better

</comment><comment><USER54> [NSFW] "Nothing Better Than Gay Sex" [https://i.imgur.com/PsRAsLi.jpg](https://i.imgur.com/PsRAsLi.jpg)

Nothing wrong with the message per se, but has the site been defaced too?

<comment><USER55> Posted four hours ago! Last.fm is truly on its last legs.

</comment></comment><comment><USER56> We really need some laws around this... Prison time for web developers that store passwords insecurely, and substantial fines for anyone whose password can be brute forced from one of these leaks.

<comment><USER57> As someone who has very strong feelings about sites not letting me choose secure passwords, or storing them insecurely...no.

Fines for storing passwords insecurely and getting breached, sure. This is already handled by PCI/HIPAA, but could definitely stand to be improved. Prison time? There's no possible way that would end well.

Fines for "anyone whose password can be brute forced from one of these leaks"? So that means 80% of people out there would be given "substantial fines". Not going to happen.

<comment><USER56> > So that means 80% of people out there would be given "substantial fines". > Not going to happen.

How is that any different than giving speeding tickets? If you behave recklessly in a way that puts others at risk, you should have to make restitution to society.

<comment><AUTHOR> Hmm not sure I understand your reasoning here.. You don't think there's a difference between speeding and choosing a weak password for a site like last.fm? The latter might be a bit silly, but how does it put others at risk?

<comment><USER56> With the Dropbox hack for example, the reason they got hacked is because one of their employees reused a password, presumably from another site that got hacked. So that's one vector, where every time a site gets hacked, people using weak passwords (and reusing them) create the risk of future hacks.

But more generally, exposing your account credentials allows others to impersonate you and potentially scam others, expose the data of others, etc. In the case of Last.fm there obviously isn't a ton of potential for abuse directly, other than maybe firing off fake song plays to pocket the royalties, but the potential for greater harm exists in the general case. E.g. consider the enormous percentage of credit card transactions that are fraudulent, largely because of scammers using PII that's stolen in these large scale hacks. That absolutely effects the fees and interest rates for everyone else using banks in any way, so even if your own identity isn't stolen you're absolutely still affected.

And even in some hypothetical scenario where the only person harmed would be the person using the weak password, there is still precedent for regulation because we have laws requiring people to wear bike helmets, preventing kids from smoking, etc.

<comment><AUTHOR> Got it, I certainly disagree and don't think the 41.000.000 last.fm users (whose passwords were cracked in two hours) should receive a substantial fine. I don't think there's a whole lot of precedence for this type of legislation either; what you're suggesting requires at least two other crimes to be committed by someone else (before someone else would potentially be at risk due to the user's bad password choice) - in addition to recklessness on behalf of the service provider (which also may be regulated and/or illegal under PCI/HIPAA/etc as grandparent points out). In other words:

1\. User signs up for a web service, uses weak password.

2\. Web service recklessly stores passwords/hashes in an easily crackable way.

3\. Someone hacks the web service, steals usernames and passwords/hashes, then leaks the data.

4\. Someone _potentially_ uses the leaked credentials/user information to impersonate user, commits identity theft, fraud etc.

5\. User receives a _" substantial fine"_ for using a weak password (like 96% of the users of this online music service).

I had written a more long-winded response, but it probably suffice to say that there are major issues/contradictions/implications of what you're proposing. Like how would you enforce it, should law enforcement only rely on data theft/leaks, or should they have direct access to all user databases for online services? How would they prove the integrity of the data leaks? How would you prove that the password is reused, and how'd determine the size of the fine? Does it matter if the password is strong, but reused and one of those services stores it in plain text and is hacked? Would it be legal to use a weak password for a service if the hashing algorithm is strong, or just as long as the service isn't hacked and the data leaked?

<comment><USER56> > How would they prove the integrity of the data leaks?

Most jurisdictions already have security breach notification laws. If you're already required to report data loss to customers and/or the government, then at that point I don't think it's unreasonable to require companies to provide a copy of any leaked credentials since they should all be deactivated anyway.

> How would you prove that the password is reused, and how'd determine the > size of the fine?

If companies were required to turn over credentials that had been breached, then this would be determined from the entire set of breached credentials.

> Does it matter if the password is strong, but reused and one of those > services stores it in plain text and is hacked?

Sure, that's exactly why you're not supposed to ever reuse passwords even if they're strong.

> Would it be legal to use a weak password for a service if the hashing > algorithm is strong, or just as long as the service isn't hacked and the > data leaked?

I think there should be some minimum entropy level that's required regardless of the hashing algorithm. E.g. given that passwords can be automatically generated and stored, there is zero reason ever to use a password that's less than 30 characters of completely random characters.

> what you're suggesting requires at least two other crimes to be committed

The fact that these crimes are interconnected is why such a law is needed in the first place. And all these attacks are automated, so if you're reusing your last.fm password on Facebook and it takes ten minutes to brute force your last.fm password, then your Facebook account is going to potentially be pwned in ten minutes and 1 second.

If there were some benefit to having weak passwords then that would be one thing, but the way I see it it's just people creating a national security risk out of pure laziness.

<comment><USER58> This is some serious Gulag Archipelago shit you're laying down here manbro.</comment></comment></comment></comment></comment></comment></comment></comment>


Codecademy Lunches Data Science Career Path - <AUTHOR> https://twitter.com/myviralmag/status/1161279305751642112 <comment><USER2> Please submit the original source. ([https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)) In this case the Twitter tweet adds no extra information to a direct link to the blog.

[https://www.viralmag.co.uk/2019/08/become-data-scientist- wit...](https://www.viralmag.co.uk/2019/08/become-data-scientist-with- codecademy.html)</comment>


Few days of Swift - <AUTHOR> http://www.jessesquires.com/swift-open-source/ <comment><USER2> Is Linux performance on par with OS X, does anyone know of a benchmark that would make sense (given the status of much of the standard lib)?</comment>


Ask HN: How do you manage your personal paper documents over the years? - <AUTHOR>

I'm working on a new Open Source application to handle Document Management for personal use and I'd love to have some insights from the people here.
It's always been my dream to have my paper documents like electricity bills, mortgage papers, bank statements etcetera stored digitally but I've never been able to find something that satisfies my basic needs:
- Not cloud-based
- Encryption
- Should be able to run without knowing how to setup a linux server
- Files put into the system should be still useable without the program files if I ever lose (access to) the program i'm using.
- Fulltext search with OCR
How does HN handle this currently? Do you store it in the cloud? on a private server? on a usb stick? or just plain old boxes and filing cabinets? <comment><USER2> I manage them by throwing them away as quickly as possible.

If I need copies of a bank statement for some reason, I go to the bank and ask them to print one for me.

</comment><comment><USER3> I've wanted to scratch this itch for years and keep putting it off. Your desires don't look too far off from mine. (I do want a relational database- based index, and I'm fine having encryption handled by the filesystem.)

For now I've been scanning the documents and storing the paper copies in boxes in the order they were scanned. My eventual hope is to import the scans into the mythical document management system, categorize the documents, then go back thru the boxes destroying any items that I don't absolutely need on paper.

<comment><AUTHOR> I'm planning to support exactly that workflow.

Drop a bunch of PDFs on the program, queue them up for (later) processing, (auto)-tag, categorize and fulltext index them. I'd be so happy when that's done

</comment></comment><comment><USER4> I have an USB stick for every year. The USB stick has a metal surface and I write the name of the year on the stick.

</comment><comment><USER5> Physical files. It sucks but so does managing digital files. The suck is in the filing not the medium.

<comment><AUTHOR> Would you agree that the suck of filing would be significantly less if you could just snap a photo with your phone, push it to an application, and later just have to handle some details on the filing?</comment></comment>


We Can't Destroy Planet Earth - <AUTHOR> http://www.hughhowey.com/we-cant-destroy-planet-earth/ <comment><USER2> Annoying pedantry.

Everyone knows "destroy the planet" means something like "decrease Earth's ability to sustain life, especially human society" as is clear from every context it's used. Of course there are edge cases, which amount to rounding errors.

Yes, people would communicate more effectively by speaking more precisely, but this post doesn't merit meaningful discussion.

<comment><USER3> well-said & hear hear!

..excuse my not knowing where better to ask:

when i see a submission as what i would classify as "clickbait"-ish at hackernews, what is the right thing to do? is that what flagging is for?

a cursory search hasn't returned me a FAQ or anything & i'm relatively new to commenting. thank y'all in advance if there's such a document available to link to.

<comment><USER4> There's a link to the FAQ on the bottom of the page: [https://news.ycombinator.com/newsfaq.html](https://news.ycombinator.com/newsfaq.html)

</comment></comment></comment><comment><USER5> I am not worried about wiping out humanity. I am worried about wiping out enough humans thst our modern civilization crumbles and never recovers, relegating us to a single planet species forever.

We have fought against entropy to get this far using the relatively easily available resources. If we fail now those won't be available for future generations.

I want future generations to lead better lives than we do, not regress. I want them to live the optimistic sci-fi future, not the post-apocalyptic ones

<comment><USER6> Earth should not be destroy, and, I am not worried about wiping out humanity either; currently, it is instead too much humanity, but if later it is too not enough compared to another species then we can worry about it.

I decide to don't have any children. Therefore, we can try to reduce the future human population, in this way.

</comment></comment><comment><USER7> You don't have to worry about wiping out _all_ of humanity to worry about climate change. Impending human suffering is reason enough to worry. "Climate is an existential threat" is obviously a hyperbole. If somebody doesn't understand it, too bad.

> What I don't like is when we exaggerate and undermine our good intentions.

I don't see how that undermines anything.

</comment><comment><USER8> Although I'm sure Howey is technically correct, I don't think what amounts to semantic quibbling is actually adding anything to the discussion.

Okay, so humanity won't be eliminated. But there will be a dramatic increase in death and suffering and overall quality of life will be drastically diminished except for those already in the top 1% of wealth. How does that distinction change the overall discussion or the importance of fighting climate change?

</comment><comment><USER9> Is the author claiming that the complete destruction of planet earth and all human kind is what the environmental debate is about?

For me it's about my grand children not ending up in Mad Max or Blade Runner.

That would truly suck... for them.

In both these scenarios the earth is around, humans are living and pretty much everything else is dead or dying.

You can always argue that whatever takes place within the boundaries of this universe is a natural progression. My bother is that we as a species know a lot of things, probably more than anything that ever lived on earth, still we keep doing obviously stupid things at scale.

This makes my computer say "no", and it's hard to rationalize as natural progression, considering this accumulation of knowledge.

My program tells me to do what I believe is best for my offspring and this seems rather natural to me.

</comment><comment><USER10> A lot of complaints here about "semantic quibbling" and the like, but I found Howey's principled relationship with language refreshing.

Today, we get bombarded with an endless stream of clickbait that routinely stretches words to the very limit of their meanings and beyond. In politics especially, double speak is now the standard. "Fake news" probably isn't fake. A "Clean Air Act" bill probably isn't about clean air. The "middle class" probably isn't really in the middle. "Job creators" probably aren't creating jobs. And on and on.

Why shouldn't we all strive to use words in a precise, straightforward way? Why embellish our argument when the plain truth is already horrifying enough?

</comment><comment><USER11> Climate change will benefit some countries according to Stanford:

[https://web.stanford.edu/~mburke/climate/map.php](https://web.stanford.edu/~mburke/climate/map.php)

Russia: +419% to GDP. Hmmm....

</comment><comment><USER12> As a tautology that might be true. We can't destroy the planet, we "just" change its appearance and its composition. Will it be a great place to live on? Not so sure about many parts of it.

</comment><comment><USER13> It _is_ apparently possible that runaway global warming (the very kind we are currently initiating (perhaps irreversibly initiated already)) could render Earth like Venus. The sun is hotter now than the last time the clathrates got released at the Permian–Triassic extinction event. This is not espoused much by mainstream climatologists but real non-crank climatologists have work supporting the fact that it is possible. Steven Hawking even publicly brought this up.

<comment><USER14> > Steven Hawking even publicly brought this up.

And was rebuked for it.

[https://climatefeedback.org/claimreview/earth-is-not-at- risk...](https://climatefeedback.org/claimreview/earth-is-not-at-risk-of- becoming-a-hothouse-like-venus-as-stephen-hawking-claimed-bbc/)

Even in the absolute worse case scenarios we'd expect to see a temperature increase of around 10C, which is nowhere close to Venus levels. Also he threw in "raining sulphuric acid" just to make it sound even more apocalyptic I guess.

Earth becoming Venus is not even a "less likely" to happen scenario, it's a completely implausible scenario even if 100% of humanity dedicated itself to releasing all carbon into the atmosphere as quick as possible tomorrow just for kicks.

Prominent scientists like Hawking publicly making such groundless and hyperbolic statements IS hurting case for action against climate change, and that's exactly what this article is talking about.

</comment></comment><comment><USER15> There is not much here to support his argument.

<comment><USER16> He isn't so much making an argument as stating a simple and fairly trivial observation. It's rather sad that hysterical alarmism has grown to such proportions as to even necessitate such observations.

My only objection to his thesis is that, if I was being pedantic, I could note that with a highly organized research and engineering effort, we could technically construct sufficient supplies of cobalt salted nuclear weapons to theoretically wipe out all organized human life on this planet if they were all launched at once. That's a purely academic counterpoint, of course, as no such supplies are likely to ever be constructed, let alone used.

</comment></comment><comment><USER17> >The universe will collapse into a single black hole.

Basically no one believes the Big Crunch theory is likely to be accurate these days, which is what I imagine he is referring to here - but it's also inaccurately stated even for that theory, because the laws of physics are so different when the universe becomes that compact that the properties that allow black holes to exist are incredibly different. Not all singularities are black holes, and indeed, the universe would not condense into a single black hole if the Big Crunch were true. If he's not talking about the Big Crunch, I have no idea what he could mean, since there's no conceivable theory in which all of the matter ends up collected in one big black hole otherwise.

I know astrophysics and climate science are very different fields, but someone writing about how Thing X but not Thing Y is actually an existential crisis, some basic understanding about the ultimate fate of the universe would be nice.

>It turns out that planetary life is a downhill chemical process if you have sunlight and liquid water.

All evidence we have is that life, or at least intelligent life, is quite rare. We don't understand abiogenesis, either. Between these two things, acting like it's a given that we'll have life in short order if we have sunlight and liquid water is absolutely silly.

>I have a short story in an upcoming anthology inspired by this point. The third entry in the fantastic WASTELANDS series by John Joseph Adams will have a story by me about a place where our worst case scenario has already happened. > (If you want to read my solution for how to wipe out all of humanity, check out WOOL and the Silo Saga. Spoiler: it ain't pretty)

Oh. It's just a long form advertisement for his writing.

As others have pointed out, no one is really arguing about whether or not humanity might survive in some shape or form in these scenarios, but it wouldn't be anything like modern civilization. Our entire modern way of life ceasing to exist is plenty existential, and there's no guarantee that if we were reduced to a population of 2000 or so again that we would survive. See again the fact that as far as we can tell, intelligent life is incredibly rare - if intelligent life can keep hitting the 'restart' button when they fuck things up, we'd probably see evidence of life existing elsewhere in the galaxy.

</comment><comment><USER18> Sure, if we're taking 'existential threat' literally it's probably not in the sense that it won't end all human life on Earth. If we take it a little looser though it is a big threat to modern civilization and that will be pretty difficult to restart just because we've mined so many of the easily available energy sources and resources.

</comment><comment><USER19> To destroy the Earth:

[https://qntm.org/destro](https://qntm.org/destro)

<comment><USER20> ugly rant

</comment></comment><comment><USER21> In the time before the hydrogen bomb there was discussion that such a device may ignite the atmosphere. If we managed to somehow do that, it may do the trick.

</comment><comment><USER22> Biggest changes will be geopolitical driven by humanitarian catastrophes. It's very much in the interest of the Western World not to allow it to happen.

</comment><comment><USER23> We can't destroy humanity. We can, however, destroy any hope that human or human-descended life makes it off this planet.

</comment><comment><USER24> > I like reducing poverty and war, because their reduction lifts the global > economy and makes travel safer and more enjoyable

a tad bit self interested, no?

<comment><USER25> And why is that an issue?

<comment><USER26> Because a lack of empathy for other human beings is problematic, because it means that as soon as your self interest does not perfectly align with their well being you will think nothing of harming them.

<comment><USER27> Its only problematic for people who emphatize with other people well being.

<comment><USER28> Even those are not magically excluded from being harmed.

<comment><USER27> Yes, which is expected. Its the reality.</comment></comment></comment></comment></comment></comment>


The Open Source Deep Learning Glossary - <AUTHOR> https://github.com/jrdi/dl-glossary <comment><USER2> Nice glossary!, I miss some terms such as regularization, sequence embedding, optimization methods (ADAM, SADAM ...), transfer learning, one-shot learning, weight initialization, test time augmentation... but in general it covers few a lot of terms. I would collaborate anytime soon!

<comment><AUTHOR> Feel free to collaborate adding these new terms or improving the already present!</comment></comment>


What I learned in 7 years, 5 apartments, and 9 roommates - <AUTHOR> http://www.brickunderground.com/blog/2013/06/lessons_learned_after_5_apartments_9_roommates_and_7_years_in_new_york_city <comment><USER4> Here's what I've learned after moving 20 times (that I can remember, including one hellish year when I had to move 9 times) in my life:

1\. Books are heavy. Some people say that a Kindle isn't as good as real books. Some people are pretty women who don't have trouble rounding up help on moving day.

2\. Getting rid of books you can't give away and have no justification for keeping is traumatic.

3\. You have more small, difficult to pack, useless crap than you realise. It unfolds like a kind of malevolent, multidimensional quantum origami when you move.

4\. For local moves, rent a 3-ton truck for moving day. Accept that this probably means moving on a work day because said trucks are booked on weekends for months in advance. Loading and unloading for a single trip is really unpleasant -- but there's something much, much more soul-sucking about doing lots of trips back and forth.

5\. Long distance moving changes the work from a single day into multiple days. On paper it should be easier. Paper lies.

6\. If you're moving long distance, don't bother with furniture or whitegoods. Ditch them and rent or buy at the other end.

7\. Help your friends move.

<comment><USER5> Absolutely agree on the 1&2 (books). Description of 3 is great wordsmithing! On 5 I rarely need a truck, just multiple taxi rides (no furniture/whitegoods, see 6). Actually once or twice I had some, but used a load-bearing Chinese peasant tricycle (oil begone!). On 7, I help people move when asked or it seems useful to offer, but personally do not deal well with other people 'assisting' due to the wont to dispose of useless things and be fully aware of what's packed in what going where. Moving should be a spiritual process, like a sort of postmodern ritual cleansing of objects. The reproductive stage of the malevolent, multidimensional quantum origami of things that leads to still more beautiful future generations or the long suspected as looming, but never acknowledged, sudden and outright genocide of its entire genotype.

<comment><USER4> People do sometimes like to display their pop spirituality by throwing stuff away when they move. There was a blog post on the front page a few days ago about it.

I don't really have a deep California buddhist-slash- _Fight Club_ reason for it. I just bloody _hate_ moving.

Anyhow, as the saying goes. Before Enlightenment, chop wood, carry water. After Enlightenment, chop wood, carry water.

<comment><USER5> With you on the pop spirituality... the posted article was semi-neurotic in tone. My own decade-long international itinerance leaves no option for 'stuff'. I used to cycle tour a lot, which is a great way to get stuff- conscious (eg. slogging it up a hill at 2000m... it really "weighs" on you!). These days I nearly always travel with a 20 liter backpack out of minimalist habit.

</comment></comment></comment></comment><comment><USER6> Some things I've learned while renting a room in a house:

* Don't store expensive alcohol or munchie relieving foods in common spaces.

* Some people don't close the washroom door when taking a leak, even with strangers around the house.

* Establish a dish washing and house cleaning protocol. Split the costs of all supplies, or have a piggy bank for this stuff. Can be used to order pizza too.

* Some people believe Febreeze helps clean your fart repository sofa. Or mask the odour coming out of the organic waste bin on a hot day.

* A low rent is more likely to attract a problematic tenant. I've seen tenants ranging from complete slobs to the two students who could not pay the rent and eventually set the basement on fire (by accident). Fix up the place at least cosmetically, buy low-maintenance plants, take pictures on a sunny day with plenty of natural light, and up the rent. Good tenants are worth the extra work.

* A short-term tenant is more likely to treat the place like shit.

* A laundry machine in the house is great. If not available, check that the laundromat is within walking distance of someone carrying massive laundry bags, and that it closes at 12am and opens at 6am, or is open 24/7.

* A walking-distance grocery store and/or fruit market is a massive plus.

<comment><USER7> Store your compost bin in the freezer. :) We do that, on its own shelf - <USER2> more bugs!

<comment><USER8> Aren't you acting against the whole compost part then?

The point is to have bugs and so on decompose what's in the compost bin, as far as I know.

<comment><USER6> I think we're talking about different things. I meant my own organic waste bin, which gets emptied into the Green Bin: [http://www.toronto.ca/greenbin/index.htm](http://www.toronto.ca/greenbin/index.htm)

</comment></comment></comment></comment><comment><USER9> For the past four years, I've moved 1-3 times per year (I work in politics, and move to wherever the interesting elections are happening).

The only universally applicable piece of advice I can give is this: Your commute matters. A lot.

Seriously. Annoying roommates, beautiful balconies, new appliances - none of these things has had nearly the effect on my day to day happiness as living within a 3-4 mile bike ride from work.

<comment><USER10> I'm curious what age bracket you fall into? Most of my work is in a city, but I'm at an age where I want things the city can't provide (more space, a back yard, etc.) so some amount of commuting is unavoidable unless I change jobs along with a move.

Appliances and balconies are one thing - but a house and a yard are unobtainable in many urban environments.

<comment><USER11> I'm early 30s and still like the city, though that's still fairly young I suppose. I agree there are some lifestyle choices involved, though. I like outdoor space myself, but I don't personally feel a need for it to be my own private yard. It's more important to me to be near large parks, waterfront spaces, nice plazas, etc.

I'd say it's a fairly common preference here (Copenhagen) even for families, although some do prefer single-family homes with private yards. One difference in the urban architecture vs. NYC is that in the nicer neighborhoods, apartment buildings often have sizable private courtyards: the buildings are built on the edges of a large block, with a park left in the middle. That park may have playground equipment, BBQ equipment and picnic tables, etc., for the use of residents (also, off-street bike parking). I don't use it a lot, but families seem to.

Some of the buildings have quite active local communities as well, which some people like: dinner clubs where people will take turns hosting a dinner party (in the courtyard when it's nice, otherwise in an apartment), your kids can play with other kids in the building, you can leave them playing in the courtyard and someone else will watch them if you need to go somewhere briefly, etc.

I grew up in a suburb myself (about an hour outside of Chicago), and it was okay all around. But I think I might've preferred something a bit denser. One downside I recall is that everything was so _far_ that someone below driving age ends up being very hampered in movement. I would have to bike 15-20 minutes just to get the houses of some friends who lived in what was considered my neighborhood. And many of my friends weren't reachable at all without adult assistance.

<comment><USER10> Your comments about green space definitely resonates. I live right next to an amazing park and am there almost daily. I'd have moved years ago if it wasn't accessible.

</comment></comment></comment></comment><comment><USER12> Also, don't look at a prospective flat in the dark, when the landlord claims the electricity is off because the prior renters didn't pay their bills.

</comment><comment><USER13> I just moved to NYC last weekend (from L.A.) and found an apartment in two days:

* a Friday/Saturday in L.A., slamming craigslist and building up a spreadsheet of leads

* a full Sunday of looking at apartments

* moved in Monday morning

I settled on a month-to-month 3bd/1ba in the East Village--no brokers involved. Buh-zam!

Now I've shifted focus to meeting people and looking for work (as a software developer)...

</comment><comment><USER14> I've moved 4 times in the last year and here are my tips (I'm trying not to duplicate anything in the TA or the other comments):

1\. Bills. Make sure you are in agreement with your roomates about them - <USER3> had an issue with a roomate that maintained that he shouldn't pay more than 10 percent of the huge electricity bill because he didn't heat his room (not directly, I might add).

2\. Choose an apartment with good insulation - this might not affect others as much as me (look the previous tip). But climate change and changing energy prices will soon this for everyone.

3\. Start looking early and use your friends to find roomates.

</comment><comment><USER15> Website won't load for me. Here's Google's cache: [http://webcache.googleusercontent.com/search?q=cache:8A_6A_v...](http://webcache.googleusercontent.com/search?q=cache:8A_6A_v8mRIJ:www.brickunderground.com/blog/2013/06/lessons_learned_after_5_apartments_9_roommates_and_7_years_in_new_york_city&hl=en&gl=us&strip=1)

</comment><comment><USER16> I learn that first impression doesn't last. I have a housemate that seemed clicked ("you're an IT student? great, i graduated from IT!") but end up annoying:

\- never flushes after urinating

\- spends 24x7 inside the house (he skips classes almost 100%) with aircond+PC+lights on, but demanding we share the bills equally

\- frequently forgets to turn off bathroom lights, tap water (when filling up his drinking bottle) and exhaust fan (after cooking)

\- leaves dirty dishes for, literally, a week or two

\- sometimes borrows pennies (smaller than $50) from me and return it after weeks even though he always says, "tomorrow bro" (i don't demand it, he simply says it), but it doesn't stop him from buying stuff like perfume

\- controlled our internet so he "owned" the majority of bandwidth

\- at his 30s

now, what do you call a guy like that?</comment>