Ask HN: US Banks supporting hardware token 2FA? - <AUTHOR> A decade ago, I spent some time living in Europe and every bank I had an account with offered a hardware token for online banking.  When I returned to the states I asked my bank USAA if they would consider offering such an option.  To my surprise, they said they already did.
Fast forward to today.  Overall, I am quite happy with USAA, but I know they aren't an option for everyone.  Also, USAA just doesn't offer savings accounts with the yields that many banks are offering today.  But every bank with a high yield savings offering I've contacted thought using a hardware token was quite the novelty. Most tried to assure me that using SMS for 2FA was really very secure.
While I've done my best to secure my cell number from porting attacks, by the nature of things I'm carrying my phone just about everywhere, versus my hardware tokens kept in a fireproof safe.
They've always said they'd refer the idea up the management chain, but so far I am not aware of any actually following through.  It seems like they'd love anything to lower their risk, but who knows.
So rather than continuing to contact banks in vain, I figured I'd ask around on HN as I know this is fairly security conscious crowd.
(Yes, I know Vanguard does support YubiKey which is awesome of them, but their money market fund yield still seems to lag behind high yield savings accounts, not to mention the 0.1% expense ratio) <comment><USER2> I know this is not answer to your question but it might help in some ways, if your concern is saving accounts what we did was disabled online banking and atm on our saving accounts with large amounts of money. We still have our checking for every day use. We hardly touch our saving and for that we have to go to the bank in person. That is the most secure way I figured so far!

<comment><AUTHOR> Sure that is certainly probably the most secure solution, but I assume that only really works for banks and credit unions with branches local to you? I guess you could arrange for wire transfers over the phone, but I feel like that is even less secure in some ways.

Unfortunately, it would seem with going with local banks is not really viable if you are attempting to maximize interest. BoA offers 0.03% and Wells Fargo 0.01%, and a local credit union is offering 0.20%. When there are banks offering over 2% interest, going with such ridiculously low interest is difficult to justify.

But indeed, it could be argued that going with a bank with poor 2FA negates the advantage of the extra 1.8%.

<comment><USER3> > _BoA offers 0.03% and Wells Fargo 0.01%, and a local credit union is > offering 0.20%_

If you can plan, buy Treasuries.

<comment><AUTHOR> Indeed, but that's the whole point here. This is money for when things unexpectedly go wrong, so it must be liquid. Yet it is also painful to let it slowly succumb to inflation as well.

</comment></comment></comment></comment><comment><USER4> Several banks joined the FIDO alliance: [https://fidoalliance.org/participate/members-bringing- togeth...](https://fidoalliance.org/participate/members-bringing-together- ecosystem/)

I'm not aware of any supporting u2f/fido2 today, but browser support is also very new, so perhaps they need broader adoption. They'd certainly motivate broader adoption. Let's see and hope.

</comment><comment><AUTHOR> I should have mentioned there is this list:

[https://twofactorauth.org/#banking](https://twofactorauth.org/#banking)

<comment><AUTHOR> So of the US companies that do offer hardware security tokens (First Tech Federal Credit, HSBC, USAA, Wells Fargo) none of them offer savings yields greater than 1%.

The split is dramatic I have to wonder if there is some deeper reason that companies with higher yields do not want to offer better security. For example, Barclays UK will provide a hardware token, but Barclays in the US will not.

</comment></comment><comment><USER5> LOL not USAA that's for sure. 12 characters is the MAX limit for passwords.

<comment><AUTHOR> [https://www.amazon.com/dp/B06XY422T9](https://www.amazon.com/dp/B06XY422T9)</comment></comment>


Botcoin, bitcoin mining by botnet - <AUTHOR> http://krebsonsecurity.com/2013/07/botcoin-bitcoin-mining-by-botnet/

<comment><AUTHOR> I put this in because reading the last bitcoin thread I realized, hey this is a good money making scheme for all those botnets out there. And then I googled it.</comment>


Scientists Say They Can Recreate Living Dinosaurs Next Few Years (2015) - <AUTHOR> https://www.entrepreneur.com/article/247402 <comment><USER2> [http://longnow.org/seminars/02013/may/21/reviving-extinct- sp...](http://longnow.org/seminars/02013/may/21/reviving-extinct-species/)

Progress.</comment>


Does back end need QA Engineer? - <AUTHOR> https://firstname.lastname@example.com/does-backend-need-qa-engineer-4820aa09b3e7 <comment><USER2> I'm not too fond of the use of the term "QA", but I totally agree with the bottom line and even more.

Every team need a "Quality" or "Test" representative, they can do actual testing or simply contribute to the common knowledge or direction of the team.

Searching for "Modern Testing" will bring up a lot of discussions around this topic, mainly focused around the modern testing principles [1]

As a side comment, when I recruit I try to (but not always succeed) to find engineers that are well equipped to perform code reviews

[1] [https://www.angryweasel.com/ABTesting/modern-testing- princip...](https://www.angryweasel.com/ABTesting/modern-testing-principles/)</comment>


Supercritical CO2 is heavy like a liquid, with weird and useful properties - <AUTHOR> https://popula.com/2019/01/29/saving-the-planet-with-co2/ <comment><USER2> Couldn't comment to the author without paying for an account there, but as someone who has actually built sCO2 reactors -- you can get away with a much lower cost HPLC pump to pressurize the CO2 if you can force it to be a liquid at the inlet side using an eductor tube and slightly heating the tank to guarantee that the slightly cooler HPLC pump head won't cavitate.

It worked pretty well, though I had to stick a TEC on the pump head. $5k instead of $100k+ for a high pressure syringe pump.

My application was to use the sCO2 to solubilize organometallic precursors to deposit thin films on particles in a fluidized bed, and one of the best reasons for sCO2 was that the only likely contamination would be carbon (sCO2 is sometimes used to form carbides intentionally).

<comment><USER3> >My application was to use the sCO2 to solubilize organometallic precursors to deposit thin films on particles in a fluidized bed, and one of the best reasons for sCO2 was that the only likely contamination would be carbon (sCO2 is sometimes used to form carbides intentionally).

I understand some of these words.

Kidding aside, what was the goal of this endeavor? What is the end product?

<comment><USER4> Let's guess. I'm going to say they are dissolving the 'precursors' into the co2, pumping it through the bed of particles with sufficient vigor to achieve 'fluidized' [1] state. As the supercritical co2 rises through the bed, the particles are dumping heat into it, ultimately flashing to vapor and leaving the solute (or at least the metallic part of it) behind as a thin film on the particle that did the trick.

This of course leaves the particle itself cooler, making it less likely to receive additional deposition and resulting in a more uniform thickness across the batch.

These coated particles are probably then going to be used as a catalyst in some other process.

[1] [https://www.youtube.com/watch?v=My4RA5I0FKs](https://www.youtube.com/watch?v=My4RA5I0FKs)

(alternate is that the the precursors themselves are the fluidized bed and the co2 is used to help move the coating from the donor to the recipient. If GP called them parts and not particles i would be more inclined to this option)

<comment><USER2> Almost! Except for the flashing CO2 to vapor, I actually just had a filter at the top to keep particles from flying out but the reactor itself was at 5000PSI and I just used a backpressure regulator for the exhaust stream which was very little since basically every byproduct was a gas. But in backstory, I invented a process, particle supercricial fluid deposition (UMass Amherst previously demonstrated deposition onto wafers and I worked with them on it through STTR), which lets you put down conformal thin films onto particles as a protective coating.

[https://www.brianneltner.com/thin-films](https://www.brianneltner.com/thin- films)

The key is conformal films and aspect ratio. If you're familiar with CVD, you might have encountered "duning" where film growth can produce unstable interfaces or find that a trench will get filled in at the top and leave a void underneath.

One common option is using ALD which uses alternating precursors so you can fully coat every surface of an arbitrarily high surface area material with a monolayer of your precursor, and then a second step converts that precursor to metal so you get atomically thick layers.

The downside of ALD is that it's quite slow in terms of growth rate because you can only grow one atom thick layer at a time. Additionally, the precursor has to have a vapor pressure high enough that the often solid precursors can actually be flowed through a reactor under vacuum. But it can get super thin films that can be conformal and which have incredible aspect ratios.

What I did was use sCO2 to _dissolve_ chemicals like those ALD or CVD precursors in an "organic solvent" (sCO2 itself) to deliver it at super high concentrations to the reactor (at like 5000PSI) instead of at super low concentrations under vacuum. It stays supercritical through the full fluidized bed. But the reactor itself is hot so the precursors spontaneously decompose and do so preferentially on surfaces. But! The key difference is that because of the high precursor concentration, instead of the film growth rate being dictated by how fast precursor can get to the particle surface (diffusion limited) it's limited by how fast the precursor reacts on the surface (kinetically limited). The prior is notorious for unstable interfaces, the latter is much better because it's just growing at max speed at all locations simultaneously.

So the real difference is that it let me deposit thin films from a high concentration precursor stream.

My actual application was trying to coat copper flake with chromium metal to increase the oxidation temperature for use as a replacement to silver conductive pastes used in solar panel manufacturing. Silver was (might still be) like 10% of the total cost of making one, so this was of keen interest and would be pretty awesome. Ultimately, I was able to make it so that copper showed no oxidation at 300C over a minute while uncoated copper did show a lot of oxidation.

However, the amount of coating I needed to keep the oxygen away from the copper was too thick (or at least I couldn't make it thinner with that tech) and the chromium was expensive enough that it'd have ended up more expensive than just using silver.

So I moved on =) A project worth doing for sure, everyone I talked to about it simply could not guess if it would work. Sadly it worked but wasn't commercially interesting in the end.

<comment><USER5> Super interesting. Comments like this are what keep me coming back to HN.

</comment></comment></comment></comment></comment><comment> gene-h Venus' lower atmosphere is actually composed of supercritical CO2 at 90 atm and ~450°C which makes corrosion interesting[0]. sCO2's property of acting like a solvent works against us in this case. Copper grows a hair copper sulphide from the trace amount of sulfur dioxide and other sulfur compounds present. Hydrofluoric acid, even though it's present at part per billion concentrations, cause corrosion problems too. While we now have interesting silicon carbide integrated circuits like image sensors[1] and 555 timers[2] capable of operating at Venusian temperatures, it's challenging to actually use them on Venus because of corrosion of the bonding pads.

[0][https://www.researchgate.net/publication/325521557_Chemical_...](https://www.researchgate.net/publication/325521557_Chemical_Analysis_of_Materials_Exposed_to_Venus_Temperature_and_Surface_Atmosphere)

[1][http://kth.diva- portal.org/smash/get/diva2:1303493/FULLTEXT0...](http://kth.diva- portal.org/smash/get/diva2:1303493/FULLTEXT01.pdf)

[2][http://www.diva- portal.org/smash/record.jsf?pid=diva2%3A1317...](http://www.diva- portal.org/smash/record.jsf?pid=diva2%3A1317070&dswid=-1305)

</comment><comment><USER6> It's amazing how wide the applications of supercitical CO2 can be -- we used it as a solvent to extract high-value lipids from algal biomass at a biofuel company I worked for:

[https://en.wikipedia.org/wiki/Supercritical_fluid_extraction](https://en.wikipedia.org/wiki/Supercritical_fluid_extraction)

But it can also be used as a 'solvent' in non-toxic and low/no-water laundry systems:

[http://e3tnw.org/ItemDetail.aspx?id=512](http://e3tnw.org/ItemDetail.aspx?id=512)

In addition to all of the benefits it can provide for energy-related pursuits as a working fluid.

<comment><USER7> It's also being used as a solvent to make high quality cannabis concentrates and extracts in place of butane or alcohol that's more commonly used now. I haven't tried them, but I know the CO2 extracted products are being used more in edibles as toxic solvents aren't used in the extraction process.

<comment><USER8> Such extracts are _too_ pure imo. Especially for edibles, I'd rather have an ethanol extract that got a run of related chemicals and some other stuff that came along for the ride... aka "flavor".

Super pure extracts that then have added back flavorings, or even blended concertos of specific chemicals, miss the charm and much of the value of taking the "light oils" off the plant. Flower is hard to fake, home extracts are easy to do, and who knows what's in that commercial oil, really?

<comment><USER7> Ah yeah, the terpenes in the strains do more than add flavour too. Different terpenes in different strains have been found to have different effects in combination with the cannabinoids in the strain. I doubt re-adding terpenes and flavouring after the fact has the same effect. I suppose I have tried CO2 extract, I have tried the prefilled oil carts with the added flavour. I don't like them. The high from them feels weird and the taste isn't great.

</comment></comment></comment></comment><comment><USER9> Applied Science has a great video (as all of his videos are) on supercritical CO2.

[https://www.youtube.com/watch?v=-gCTKteN5Y4](https://www.youtube.com/watch?v=-gCTKteN5Y4)

<comment><USER10> Codys Lab did a video as well; [https://youtu.be/4Z-KbcLs- yo](https://youtu.be/4Z-KbcLs-yo)

</comment></comment><comment><USER11> It seems like this link from the article deserves its own front page story: [https://www.ge.com/reports/call-ecomagination-ge-building- co...](https://www.ge.com/reports/call-ecomagination-ge-building-co2-powered- turbine-generates-10-megawatts-fits-table/)

That's pretty neat.

</comment><comment><USER12> Martyn Poliakoff of Periodic Videos fame has done a lot of work with supercritical CO2, particularly in the context of more environmentally friendly organic solvents.

This 5 minute video provides an excellent summary: [https://www.youtube.com/watch?v=yBRdBrnIlTQ](https://www.youtube.com/watch?v=yBRdBrnIlTQ)

</comment><comment><USER13> Some molten salt reactor designs were planned first with helium turbomachinery and later with supercritical CO2.

Also GE tried to sell gas turbines for ship propulsion. You get back some efficiency with a CO2 turbine running with the waste heat. Ship owners still like their diesels. Really long time between overhauls.

<comment><USER14> > Also GE tried to sell gas turbines for ship propulsion.

Pretty common for warships though, or at least that's my understanding. The Arleigh Burke class [0] is powered by GE gas turbines, for instance.

Though the requirements list for "large surface combatant engine" and "huge cargo vessel engine" are probably more than a bit different.

0: [https://en.wikipedia.org/wiki/Arleigh_Burke- class_destroyer](https://en.wikipedia.org/wiki/Arleigh_Burke-class_destroyer)

<comment><USER13> Yes. They pay little for fuel. Also afaik they do not use the waste heat. Though probably with the logistics train to some places the fuel can probably be expensive at times.

There used to be passenger ships with turbines too. They changed the engines to regular diesels at some point. [https://en.m.wikipedia.org/wiki/GTS_Finnjet](https://en.m.wikipedia.org/wiki/GTS_Finnjet)

<comment><USER15> I think they actually do reuse the waste heat in a way, not via steam, but by being recuperated.

</comment></comment></comment></comment><comment><USER16> The other interesting thing is it can be used within a 100% carbon capture power plant that happens to generate more liquid CO2 which is inherently trapped within circuit of the plant. (and is presumably tapped off to sequester in places - this is said to be better than trying post collect and sequester the gas in a regular system).

[https://en.wikipedia.org/wiki/Allam_power_cycle](https://en.wikipedia.org/wiki/Allam_power_cycle)

</comment><comment><USER17> Supercritical liquids are generally weird. H2O, for example, changes from being a polar solvent to a nonpolar solvent -- you can dissolve oil in supercritical water, and even burn it if you have a source of oxygen. It's also more corrosive -- which is relevant if you're considering using supercritical water in a nuclear reactor.

<comment><USER18> > even burn it if you have a source of oxygen

How does that work? What are the combustion products? The closest reference I could find is this, [https://science.nasa.gov/science-news/science-at- nasa/2014/1...](https://science.nasa.gov/science-news/science-at- nasa/2014/10jan_firewater) , which seems to be talking about something else.

<comment><USER17> Easiest case of this: You have a tank of water and oil under supercritical conditions, and you pump high pressure oxygen gas into it. You get a "flame" around the intake, but unlike a regular flame (which is the boundary between fuel and the surrounding oxidizer) this is the boundary between the incoming oxidizer and the surrounding fuel.

The combustion products are the same as you would get in the absence of the supercritical water -- typically H2O and CO2 -- but they're all contained inside the supercritical water tank, which makes this very convenient for e.g. disposing of chemical weapons.

</comment></comment></comment><comment><USER19> I guess supercritical CO2 can be a decent refrigerant as well.

[https://www.greenbuildingadvisor.com/article/a-heat-pump- usi...](https://www.greenbuildingadvisor.com/article/a-heat-pump-using-carbon- dioxide-as-the-refrigerant)

<comment><USER15> AFAIU it's quite common in supermarket/warehouse refrigerators and freezers. Apparently upfront cost is slightly higher, but the refrigerant is cheap and there's no risk the next iteration of the F gas legislation will make your investments a dead end. And of course the environment friendliness is important to businesses that are concerned about their image.

</comment></comment><comment><USER20> I spent a summer in college working in a chem laboratory with no air conditioning. Sometimes I would give the big standing CO2 cylinder a shake, and if I didn't hear any sloshing, I knew we were in for a rough day.

</comment><comment><USER21> Holy moly, until now I had absolutely no idea about the existence of supercritical CO2. And now all the comments here are making me so incredibly fascinated and excited about the potential utilities for stored CO2. I am thinking not in terms of the science, but actually making a business case for CO2 storage _beyond_ just CSR projects!

</comment><comment><USER22> "GE has built a prototype which is small enough to fit on a desktop" \- The linked page ([https://tinyurl.com/y2s9z69d](https://tinyurl.com/y2s9z69d)) claims 10 MW output - This is several orders of magnitude "north" from the reality (~ 15 kW).

</comment><comment><USER23> From what I can gather, the chambers are quite small due to the pressure issues. This has the result of making aerogel, typically produced with supercritical carbon dioxide, come in comparatively small chunks, especially at the hobbyist level. It's a pity.

</comment><comment><USER24> Nice! I was just wondering the other day with water having so many weird ice forms and what not what do we know about other common chemicals and their states of matter

</comment><comment><USER25> Fantastic article, very well written and informative with lots of great links (e.g. diamond anvil).

</comment><comment><USER26> sCO2 is also used for the production of aerogel: [https://en.m.wikipedia.org/wiki/Aerogel](https://en.m.wikipedia.org/wiki/Aerogel)

</comment><comment><USER27> Link doesn't display on mobile devices.</comment>


Book "A Quarter Century of Unix" for Download - <AUTHOR> http://wiki.tuhs.org/doku.php?id=publications:quarter_century_of_unix <comment><USER2> This should now be referred to as "The _First_ Quarter Century of Unix" at this point, given that it's from 21.5 years ago.</comment>


High-performance, persistent, reliable and dumb-simple messaging queue in Rust - <AUTHOR> https://github.com/johnmq/john

<comment><AUTHOR> By the way, if somebody wants to hack on it with me, then just email me a message (email is in readme of the project), so we can collaborate. And if you feel like you can just submit a PR.

</comment><comment><USER2> what about licence? don't see any

<comment><USER3> It's MIT [https://github.com/johnmq/john/blob/master/src/lib.rs#L3](https://github.com/johnmq/john/blob/master/src/lib.rs#L3)</comment></comment>


How China Won and Russia Lost - <AUTHOR> http://www.hoover.org/publications/policyreview/72997307.html

<comment><USER2> "The largest number of overseas Chinese, most of whom were refugees from China, resided in Hong Kong and Taiwan, and China's first lesson in global exchange was from nearby Hong Kong. Before communist rule, the inhabitants of the capital of Guangdong (adjacent to Hong Kong), were considered city slickers, while Hong Kong was full of country bumpkins. As Hong Kong surged, several million Guangdongese escaped to Hong Kong, where they participated in its economic miracle. Friends and families lined up in long queues in Guangzhou to receive hand-me-downs from their Hong Kong friends and relatives. Young urban women wanted to marry only men with overseas family relations.15 When the Chinese government first set up Special Economic Zones in Shenzhen (near Hong Kong), Zhuhai (near Macau), Shantou (the hometown of Hong Kong refugees), and Xiemen (near Taiwan), the Chinese borrowed their new rules and regulations directly from Hong Kong. Guangdong entrepreneurs copied the Hong Kong model of 'Front Shop, Back Factory,' while others set up joint factories together with Hong Kong small business owners."

I watched this process occurring in the 1980s, with the later participation of business persons from Taiwan (noted later in the submitted article). Having a culturally similar alternative model (Hong Kong and Taiwan with different political rules and different economic structures) was crucial in helping China make a smoother transition to sound rather than irrational economic policies than Russia has been able to achieve thus far.

</comment><comment><USER3> I upvoted this article because I think there are some neat lessons in it about 'cooperative entrepreneurship' for lack of a better term. I am surprised, for instance, that more groups of American startups do not self organize into the kinds of 'business cooperatives' that you see a lot in China.

Having mentioned that, I understand that this guy is cherry picking facts to fit his particular world view, or narrative. Liberal and Conservative academics are known to do this in their work. Especially the ones who work at think tanks dedicated to espousing a given world view.

I think it is important, however, that we are able to read through a lot of these works picking out useful lessons. Seeing an example of farmers (entrepreneurs) working together, and what that model eventually morphed into industrially in places like Ningbo is useful. I have always wished for an in depth analysis of these formal and informal Chinese business structures. There is probably something we can learn from that.

</comment><comment><USER4> There is an interesting analogy to India too, which had a sclerotic, state- dominated economic system for 40+ years. India had far less of a dispora than China, but far more than Russia. And India's economic reforms have been half- hearted, and results have been in between China and Russia.

</comment><comment><USER5> Oh yes, China succeeded economicaly because it is such a free nation.

And while we should commend China for the impressive freedom of its citizens and the resulting economic wealth, we should forget the humble messenger. Isn't it great that we have such stalwart libertarian scholars like the hoover institution that helpfully point out and commend nations that are truly free. With institutions like these in the US, I bet every dictator in the world is shaking in his boots.

<comment><AUTHOR> Have you read the text ?

<comment><USER5> Yes, I read it and learned a lot. Apparently Russia lacked a diaspora. I never knew that! In fact, I am burning all my Vladimir Nabakov books on the grounds that he is a liar.

Also the Chinese wanted reform and the Russians did not. Gorbachev somehow conned the entire Soviet Union to end communism when everyone wanted it to keep going.

Basicaly a lot of lessons learned.

<comment><USER6> Like they said in the article "A few Russians had emigrated to the United States and Israel.", though the number is probably much smaller in comparison.

I think it's saying that Russia being more urbanized, the Russians' lives were much better off to begin with, so there wasn't as much momentum for change. If you compare per capita GDP, Russia is still about three times as much as China, the margin was even bigger back then.

The reform happened mostly in the countryside, while in cities the workers under the protective umbrella of state-owned enterprises were much more resistant to change. It just happened that Russia had a larger portion city workers than China.

<comment><USER5> Yes, he mentions a few Russians emigrated, which is an incredible understatement. And he does not reconcile this fact with his theory which assumes exactly the opposite.

Regarding your other argument you are giving the writer too much credit and putting words in his mouth. He does not mention comparative GDP.</comment></comment></comment></comment></comment>


The Road to Y Combinator - Part 1 - <AUTHOR> http://adriancunanan.com/blog/2013/3/29/the-road-to-y-combinator-part-1

<comment><USER2> Just read your blog post. Thanks for the link and good luck. I may write a blog post about a few changes to the YC application. If your startup has a working prototype and you want some press, post or email me the link. I will mention it in a blog post.

My one comment for every applicant: Realize the "3% chance" is often misunderstood. It's in one of PG's essays, but I can't find which one specifically. The 3% chance doesn't mean that all applicants have a 3% chance. It means that 3% of applicants have a really great chance and 97% have no chance. So your odds of getting an interview are either really good or non- existent.

<comment><AUTHOR> Thanks for the creating YC Universe. It was a great resource for us to reference. Our startup has a clickable prototype that we are sharing with investors. But we would appreciate a link to <http://thrivestreams.com>. Our private beta is on the cusp and we would love to have more people sign up. Thanks in advance!

</comment></comment><comment><USER3> Our team is in the same boat and I think you're entirely right regarding how beneficial the application process has been.

The concision required of some of the questions was cleansing: Even if I couldn't hit 120, I know I took a scalpel to the ideas we were tossing around in order to pull out those few nuggets of gold.

Best of luck, Adrian. Maybe we'll meet over the summer!

<comment><AUTHOR> Thanks Lucas! Best of luck to you too. Did our tips line up with your own process? I'd be interested to here what other resources and references other use.

I suggest using iPG (<http://www.jamescun.com/ycs12/>) to prep for an invitation for interview for your team.

<comment><USER3> Sorry about the long delay!

Your tips certainly did line up with our process. Most of our resources were drawn from friends and colleagues who are working in the venture capital firm. In retrospect, those tips were more industry specific and funding-level specific than we had expected.

Oh well! We've learned a lot regardless of the outcome. I've tried the above tool and its helped cut down our pitch duration by nearly half. Thanks!</comment></comment></comment>


Building a Stateless API Proxy - <AUTHOR> https://blog.thea.codes/building-a-stateless-api-proxy/ <comment><USER2> Firstly, great writing. Secondly, magic proxies are awesome. And pyca/cryptography instead of something terrible like pycryptodome! All great stuff.

Some critique of the crypto bits, since I'm a crypto person.

1\. Do you actually need asymmetric cryptography for this? It seems like at some point the proxy has full authority, and it could just encrypt the token for you symmetrically? (This is valuable because symmetric crypto is a lot less precarious than asymmetric crypto, see next point)

2\. Please don't use PKCS1v15 padding for encryption in new systems. It's been known to be busted for about 20 years now. We have workarounds, and they may well be deployed in the exact context you're using it. But they keep breaking, because we just have them to keep the infinite amount of already-deployed software running, not because we think it's fundamentally fixable. This is also the textbook example of a vulnerable service: one that takes ciphertexts and decrypts them on demand. With PKCSv15, I can modify the ciphertext so that _the way you treat the modified ciphertext_ tells me something about how to make private key operations. And in this setup, that means I get the real token, so that sounds bad. The good news is that you've successfully designed around it by adding a signature, so I don't think it's mountable... but. Please, no more PKCS1v15 :-(

3\. It feels a little awkward to use JWT for the outside signature but not the inside encryption. But less JWT is a good thing :)

Concrete suggestion: use Fernet (you're already using pyca/cryptography) or libsodium's secretbox and then all of the crypto problems go away. You keep the security engineering dilemma of stateful v stateless proxy (do I want the real token in the proxy at all?) -- but that's another argument.

<comment><USER3> This great feedback. I'm definitely not a crypto expert. I'm happy to update the post with a different padding algorithm if you want to suggest one. I'm a little hesitant on swapping out RSA because I intentionally picked something relatively simple and familiar to folks, but yeah, will still do some research. Others had suggested ECC which I think is totally worth noting in the post one way or another.

Thank you!

<comment><USER2> The answer to your question is OAEP but I feel like I'd still be doing you a disservice there because I am convinced the answer ought to be box/secretbox or Fernet or AESGCM maybe -- but that hinges on my question about asymmetric cryptography which is elsewhere in the thread :)

<comment><USER3> Okay, it's updated to use OAEP and PSS padding. Thank you!

</comment></comment></comment></comment><comment><USER4> Just a quick supportive comment on this - it's a really nice piece of writing, introducing a topic which tends to cause people to glaze over, and doing it in a very approachable and easy to pick up way - and that takes some skill and effort!

<comment><USER3> Thank you so much, I really appreciate the kind words!

</comment></comment><comment><USER5> Using Elliptic Curve cryptography would've resulted in much smaller signatures, libsodium is considered secure and has bindings to most sane/modern environments: [https://download.libsodium.org/doc/](https://download.libsodium.org/doc/)

JWT also has its fair share of security issues in itself: [https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is- ba...](https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard- that-everyone-should-avoid)

<comment><USER6> That JWT link sounds like hyperbole.

Can anybody chime in on whether JWT is absolutely broken as stated in the article, or, while it has some issues, the author likes being a bit too dramatic?

<comment><USER2> JWT is multiple layers of bad. My favorite summary is that it has poor implementations of a harebrained scheme designed to solve a problem you don't have.

The idea that I need to read the header, which is unauthenticated, to parse the token violates the Cryptographic Doom Principle. Has that led to vulnerabilities? Of course it has: I just said it violates the Cryptographic Doom Principle.

The idea that it has everything plus the kitchen sink -- even for drastically different behavior and opinions on how the world works, from symmetric encryption to asymmetric signing and multiple implementations of each at that, is anathema to modern cryptographic design. Wireguard has one scheme and it does a lot more complicated stuff than "encrypt a session token".

JWT's saving grace here is that few people implement all of it. And ... that's ... cool? Until they do, of course.

You can argue that something is an implementation problem and not a spec problem. Some issues definitely are, but if every major implementation has the same damn bug, then I think it's a spec problem. Unauthenticated headers are a spec problem. PKCS1V15 enc is a spec problem. The fact that an implementation can patch around it doesn't make it not a spec problem. I'm sitting on several more vulns in ~every JWT library that are, to cryptographers, literally too boring to publish even though one of them is _key recovery_.

Other posters have said that it's silly to say that merely the ability to use it unsafely is a problem. But good crypto looks exactly like bad crypto while you're doing it, and there's good crypto that doesn't have that set of problems, so why would you ever choose the poor design?

(Don't use JWT.)

<comment><USER7> Most people use the JWT compact serialization, which cannot carry the unprotected header at all. If you're exchanging JWT compact tokens, the header is protected by the signature or the encryption.

<comment><USER2> What? You mean protected by the _MAC_? The header is never encrypted: the header is how you even figure out what to do with the rest of the message at all. That is why it definitionally can not be protected by it (that's the definition of the cryptographic doom pricnople!) and is how the bugs I am referencing are exploited to begin with. The only sense that a JWT header is "protected" is that the spec calls it that.

Have you ever exploited a JWT vuln? Which one? Because odds are there's a way it boils back down to the JWT header design choice being silly.

I mean there's an easier way to have this conversation: if the header is "protected", how did the alg=none bug ever work?

<comment><USER7> In a JWS the header is integrity-protected by the signature if the alg isn't none. This is prominently noted in the specs and alg=none artifacts are referred to as "unsecured JWS". In a JWE the protected header is integrity protected by the AEAD cipher, because all encs must be AEAD.

The alg=none substitution issues happened because of bad usage of mediocre libraries. Other algorithm substitution can arise for the same reason. The invalid curve attacks were the ones that the spec didn't call out as a security consideration.

I support the arguments that say algorithmic agility is a bad idea and a new protocol with algorithmic agility shouldn't have come out at a time when other protocols (like TLS) were finally starting to catch on to this fact. But the JWT cat is out of the bag, and won't go back in: it's widely deployed and people are using it thinking it's solving problems they actually have. Education is the proper remedy.

The PASETO effort attempts to provide better answers and better design to an audience familiar with JWT, but there's also been an uptick in the kind of advice that heavily condemns JWT without supplying some migration paths. That latter brand of advice is harmful.

<comment><USER2> Same points I made before: if more than one library has a flaw, it's a design flaw and not a one-off implementation flaw, and if you're trusting the header before you validate (which is necessary!), then it is not meaningfully protecting anything, which is why those bugs work.

And, finally: we've put together an extensive list of recommendations, repeatedly, both in general and in the articles on this thread.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Slightly OT: Github has API rate limits that often slaughter us (we use Jenkins to scan our Github org), and will get worse in the future as we move/create more repos. Could this be used to alleviate that? I believe that would need some caching, but ... I don't know how caches work exactly, and how I would go about implementing that here...

<comment><USER9> Take a look at Maintner, a tool made by the Go team to load and store GitHub metadata, particularly issues, comments, reviews, and events: [https://godoc.org/golang.org/x/build/maintner](https://godoc.org/golang.org/x/build/maintner). It handles backoff, holds all data in memory, and supports backing up data to GCS.

My team is successfully using it to track ~200k issues/PRs across ~300 repos. We wrapped our deployment in a minimal API to give our infra blazing fast access to that data without needing to worry about GitHub auth or rate limits (since Maintner handles that).

And, we use the proxy described in the article.

</comment></comment><comment><USER10> This is great! A couple of years ago I needed to write a quick-and-dirty proxy in Golang to get around some draconian security policies placed on us by the team running our GitHub: Enterprise server. We released it as an open-source project here: [https://github.com/electric- it/hubbard](https://github.com/electric-it/hubbard)

</comment><comment><USER11> Is there a reason why they don't encrypt both the token and the permissions?

This would remove the needs of a signature altogether.

<comment><USER12> You still need an integrity check or signature on the encrypted data, otherwise it's potentially possible for someone to tamper with the ciphertext to change specific parts, such as the permissions.

If you are encrypting using an AEAD cipher like AES-GCM or ChaCha20-Poly1305 then it is already built in. But AES-CBC and others need an explicit verification on top.

<comment><USER13> Ok I'm a bit of a cryptography noob, but are you saying it's possible to alter the encrypted token such that when decrypted by the private key the permissions are changed, in this example, but the real GitHub token is not?

Edit: nevermind, I think I've just misunderstood the process outlined in the article. I confused the tokens.

</comment></comment></comment><comment><USER14> I built something similar for the Amazon SES (Simple Email Service) for my cron jobs and other private applications to use.

[https://github.com/ricardbejarano/postino](https://github.com/ricardbejarano/postino)

</comment><comment><USER15> As the article mentioned, revocation is a problem with the stateless approach. I've never seen a way to revoke individual tokens statelessly -- you either need to maintain state about the valid tokens, or maintain state about a revocation list.

<comment><USER16> I don't think it's possible to do revocation in a stateless manner. The token that you are revoking was once valid, and when you decide to invalidate it, this change of state needs to be persisted somewhere. But yeah, if revocation is rare and only few tokens are invalid at any given time (which can be easy by adding an expiry field to tokens), keeping a revocation list is the way to go.

</comment></comment><comment><USER17> Cool stuff! I use a similar thing in my own servers to generate short-lived or one-time access to individual requests. Nice to be able to share an url or `curl` command with somebody to see what I am seeing or for ad-hoc permission grants.

</comment><comment><USER18> How does the proxy get the initial token? Do you hand it a GH token and get back your magic token?

<comment><USER19> Yes, it has an API you can call that will encrypt the token with the proxy's key. Implementation here: [https://github.com/theacodes/magic-github- proxy/blob/master/...](https://github.com/theacodes/magic-github- proxy/blob/master/src/magicproxy/async_proxy.py#L32)

</comment></comment><comment><USER20> Anyone knows what tool is used to generate/ those images in the post?

<comment><USER3> I hand-drew the illustrations using an iPad pro & photoshop. The code highlighting is using Sphinx + witchhazel.thea.codes.

</comment></comment><comment><USER21> This begs the question why not be github? I bet some permutation of this idea occurs to the next developer.</comment>


Ask HN: Canadian junior dev wanting to move to the US. need Visa advice - <AUTHOR>

Hi everyone, I completed a web development bootcamp and around 8 months ago and have been working in startups in Hong Kong. I'm looking to relocate to the states (LA, San Francisco etc.) soon. I'm a Canadian so I do have an advantage in attaining a work VISA, but I dont know how much. My questions are:<p>1) How easy would it be to get a work visa? 2) Where should I be looking for jobs at? 3) I'm a junior level developer, looking to target front end jobs in javascript/jquery/angular, but have some experience with javascript and ruby backends... are people only wiling to give VISAs to more experienced people? 4) How much would it increase my chances if I were to fly over there without a work visa and job search then, so that I can interview face to face? 5) What kind of companies should I target? Big companies like GOogle I'm probably not qualified for, but companies that are too small may not offer work visas 6) Any other advice would be great. <comment><USER2> As a Canadian, the TN visa is by far the easiest get. If you qualify, you just get it at the border when you enter. You typically need a job offer, be qualified for the job, and the job needs to be on this list:

[http://www.nafsa.org/_/file/_/amresource/8cfr2146.htm](http://www.nafsa.org/_/file/_/amresource/8cfr2146.htm)

The TN visa has the advantage that the company doesn't need to do anything really, just make sure the job description ticks all the boxes for the immigration officers at the border. Other visa classes are more complex and costly (H1-B) and usually have the same kind of qualification requirements.

"Computer Systems Analyst" is the usual job title for programming jobs, you will need either a degree, or some post-secondary school training + 3 years experience. You can probably word your degrees + training to satisfy the education requirement.

The steps to get this visa are outlined here:

[http://travel.state.gov/content/visas/english/employment/naf...](http://travel.state.gov/content/visas/english/employment/nafta.html)

<comment><AUTHOR> i have a degree in Statistics (from a college in the states), and a master of science in e-commerce (from a college in HOng Kong). Does that qualify me for the "computer system analyst" bit? im currently based in Asia, should I consult the local US consulate?

And if I get this TN visa, if I switch jobs, I dont need to renew it right away or anything right?

<comment><USER2> You need a new TN visa if you change jobs. You can do it by mail, or by leaving/re-entering.

It's up to the border officer to decide whether you meet the critera or not. They're not experts in any particular field, so generally, they look to make sure that all the right keywords are hit in the job application and your qualifications.

Contacting USCIS will generally only get you generic advice. An immigration lawyer, while not necessary to do the paperwork (it's pretty easy) should be able to give you a reasonable opinion as to whether you'd be successful or not. They're the only people that deal with this often enough to have a feel for when an application might be successful or not.

Do some google searching on "TN visa" and "web developer", there are lots of stories out there that should give you a feel for what's involved.

</comment></comment></comment><comment><USER3> 2) Where should I be looking for jobs at? Look at [https://techmeabroad.com/](https://techmeabroad.com/) a tech jobboard that only lists jobs coming with a working visa.

</comment><comment><USER4> Do you have an engineering or CS degree? That would help your chances a lot.

Most developers get into the states with either a TN Visa or H1-B Visa.

<comment><AUTHOR> Hi, I do not have a CS/engineering degree. I have a BS in Statistics from a top 20 University, and masters in e-commerce... does that help?

What kind of companies should I target though? I'd love to work in a start up but would they bother with helping potential employees with visas? Should I target bigger companies? Or do they have too many applicants to even look at mine?</comment></comment>


Ask HN: How do you meet experts from other fields? - <AUTHOR> <comment><USER2> Honestly if you familiarize yourself with a bunch of their research you can probably just email them and get an answer.

Like you might think you can't do that, but most people will be happy to get a flattering email about their research with a couple clear well written questions they can easily answer.

</comment><comment><USER3> Via my hobby, keeping scorpions, I have been on several field trips with experts while living in Mexico.</comment>


Patent case against GNOME resolved - <AUTHOR> https://www.gnome.org/news/2020/05/patent-case-against-gnome-resolved/ <comment><USER4> The GNOME Foundation established a legal defense fund to fight this suit which has raised over $150,000. Their plea on the site soliciting donations states;

"GNOME, the free software desktop has been hit by a patent troll. It's the first time a free software project has been hit by this, and we want to send a message to all patent trolls out there - we will fight your suit, and we will have your patent invalidated."

It is disappointing to see the GNOME Foundation settle in this manner rather than pursue the patent invalidation case fully as implied in their fund raising site and pretty explicitly in the blog post announcing the fund. I imagine a significant number of donors will also be disappointed making trying to raise such funds for any future defense more difficult.

<comment><USER5> While I understand the financial motivation to settle in this way - <USER2> these bogus patents invalidated takes a lot of lawyer time/money - <USER3> this piece of fluff does leave a nasty aftertaste, almost as if those _Rothschild Patent Imaging, and Leigh M. Rothschild_ are anything but the bottom-feeding pond scum detritus that they really are.

<comment><USER6> Well, you have to read between the lines a lot on these kinds of announcements, but what I see is a massive win for Gnome:

 _GNOME receives a release and covenant not to be sued for any patent held by Rothschild Patent Imaging. Further, both Rothschild Patent Imaging and Leigh Rothschild are granting a release and covenant to any software that is released under an existing Open Source Initiative approved license (and subsequent versions thereof), including for the entire Rothschild portfolio of patents, to the extent such software forms a material part of the infringement allegation._

<comment><USER4> I think most people can see it is a win for GNOME but it is far short of the goal the GNOME Foundation proclaimed when it went out raising money.

</comment></comment></comment></comment><comment><USER7> I don't understand the negative reactions here.

Gnome got Rothschild to agree to never sue another open-source project again. That's a huge concession and an outcome that's arguably better than a few invalidated patents.

<comment><USER8> I guess that depends how much of the Rothschild portfolio is applicable against open source software. A few invalidated patents, _plus_ a strong message that trying to put a FOSS project through the ringer will get your patent invalidated could be far more powerful than just one promise from one entity.

Also, there's a question of how widely this legally binding promise is... will it apply to anyone else who wants to buy these patents?

</comment></comment><comment><USER9> Initial announcement of the lawsuit: [https://www.gnome.org/news/2019/09/gnome-foundation- facing-l...](https://www.gnome.org/news/2019/09/gnome-foundation-facing- lawsuit-from-rothschild-patent-imaging/)

Discussion on HN at that time: [https://news.ycombinator.com/item?id=21071699](https://news.ycombinator.com/item?id=21071699)

</comment><comment><USER8> There are lots of things I don't understand about this:

\- GNOME raised lots of money to help fight this case [1] - yet the lawyers supposedly worked on it pro-bono. So is there an implication that this money has instead gone straight to the patent troll's pockets, or will the GNOME project get the benefit of that money? Are there associated costs of the litigation that could easily consume the $150K?

\- They have claimed that no OSI-licence-approved project will be sued. They have not prevented closed-source projects from getting sued, and presumably any closed-source project that makes use of open source components will still be sue-able? For example, a kiosk app that is delivered with a GNOME-based distribution would be completely unprotected, presuming they distribute this software?

\- This patent is likely very invalid [2] - so it is very much not in Rothschild's interest to have this case see the light of court - so how did we get to this point?

I'm not expecting any official answers here of course, but the whole thing is exasperating

[1]: [https://secure.givelively.org/donate/gnome-foundation- inc/gn...](https://secure.givelively.org/donate/gnome-foundation-inc/gnome- patent-troll-defense-fund)

[2]: [https://www.patentprogress.org/2019/09/26/mythical-troll- att...](https://www.patentprogress.org/2019/09/26/mythical-troll-attacks- gnome/)

<comment><USER10> > So is there an implication that this money has instead gone straight to the > patent troll's pockets

Neil McGovern said elsewhere¹ that GNOME "have not paid RPI or Leigh Rothschild for this settlement".

¹ [https://lwn.net/Articles/821137/](https://lwn.net/Articles/821137/)

<comment><USER8> Hadn't seen that. Good to hear.

</comment></comment></comment><comment><USER11> I don't understand who is happy in all this since 10 month of work are lost on basically nothing?

</comment><comment><USER12> Nothing says you support open source causes like suing them

</comment><comment><USER13> Why pro-bono? Doesn't Red Hat make lots of money?

<comment><USER14> The GNOME Project does not belong to Red Hat. They are just one of many sponsors.</comment></comment>


Reviewing Bad Schematics as EE Interview Tactic - <AUTHOR> https://cushychicken.github.io/bad-schematic-interviews/ <comment><USER2> We've used what we call the "Kobayashi Maru" coding exercise with developers.

It was code deliberately filled with various errors, from JavaDoc with @param names not matching argument names, to generic issues, to more subtle issues. One of the last ones involved threading and concurrent access. It also had a test suite to help candidates gauge their progress for programmatic issues, not so helpful for code style issues (that JavaDoc comment).

Basically, we wanted to see the dev a) look at the reds and yellows in their IDE, b) run the tests, and then c) prioritise the issues. And d) say "these tests are wrong"

It was a highly effective filter for people with "qualifications" from dubious private training institutes (one candidate fixated on the red Javadoc for a mismatched parameter name, we hinted that he check the arguments in the method, he muttered "method, method, method..." to himself while scrolling down the code looking for the actual word 'method' \- spoiler, he didn't find it, and he didn't get the job), but we left it behind when we found it was causing candidates genuine anxiety when they couldn't get all the tests to pass - which was intentional - anyone who figured out that the tests were deliberately wrong was an instant hire.

But we felt it was unfair, it's very very hard in a job interview to say "hey, I think your tests are wrong" so we dropped it.

These days, we use a simple filter - write code in your preferred language to find the element in the list that only has one occurrence. It's surprisingly effective as a first pass. People with years of Scala on their resume from writing Spark jobs, who choose Scala, but who can't quite get the hang of how you define an array of X in Scala... when you find yourself telling them to use square brackets for generics instead of angle brackets, you learn a lot about their actual capabilities vs. their projected.

<comment><USER3> I thought at least in TDD your tests could "never be wrong" since you have to write code that makes the tests pass, not vice versa

<comment><USER4> I practice TDD frequently (whenever suitable).

The tests are wrong 70% of the time. Either a silly mistake, the design wasn't conceptualized properly (or was changed), or just plain bad code.

If you're tackling your suite one test at a time, and committing code that solves just that test, seeing it fail and then pass, and thinking about why, everything will be fine. If you batch things, or don't debug success, you'll ultimately be buggy.

</comment></comment></comment><comment><USER5> Things that come to mind for bad schematic review:

* Linear voltage regulator with high input voltage powering an obviously very power hungry load.

* No ESD protection/current limiting for sensitive pins exposed to outside world.

* Tantalum capacitors with very narrow voltage rating margin

Another tactic I like (something similar is mentioned in sibling comment): a small design problem representative of real life task.

For generic EE position I like the following: "Suppose there is a project using this microcontroller. Project requires this micro to power an externally connected solenoid with this specification."

I find this reveals a lot of the seniority/thought process of the candidate: what (if any) questions candidate is asking to better understand the problem ("Do I need to consider output short circuit? What are the cost/size constraints? Don't we need a internal/external feedback?"), what is their process of component selection (if that is required in job description) and the suitability of this process for the needs of particular company.

Now, if only I could come up with similar strategies for software positions...

<comment><USER6> The same approach works. Under-specify a problem, then see what questions candidate asks, and at what level they jump in. When Windows used to ship with Minesweeper, I'd ask candidates how they'd approach implementing Minesweeper for a touchscreen on an embedded device. Good candidates would get clarity on hardware and constraints first.

</comment></comment><comment><USER7> _My example of this: I have yet to meet a junior EE candidate who understands the need for decoupling capacitors in digital circuits_

That says a lot about the state of education. I'm not even officially an EE, and only did some embedded hardware stuff and some electronics as a hobby, yet I know what that's about.

<comment><USER8> It seems strange that the author has not met a single one that understands that concept since it is quite basic. I am guessing he just is bad at interviewing and asks trick questions till he meet someone who know the interviewing game inside out.

Examples he gives:

"Current limiting resistors missing (BJTs, diodes, etc.)

Shorting a potentiometer node to a rail

Voltage regulators missing capacitors at input/output

Missing pull-up/pull-down resistors on digital buses

Missing decoupling capacitors"

I mean ... looking at a schematic how should you know that the voltage regulator doesn't have internal caps without seeing the specs? Missing pullups? How do you know those are not internal? It is stupid.

<comment><USER7> _how should you know that the voltage regulator doesn 't have internal caps without seeing the specs?_

Can you name one voltage regulator that has them? Maybe you've worked with a few, but just off the top of my head, the 78xx, 317, and 1117 don't, and neither do all the other miscellaneous ones that I've seen in consumer electronics.

<comment><USER8> Traco Power has some. I don't know which one we used on the top of my head but kinda like this with fewer pins: [https://www.tracopower.com/products/browse- by-category/find/...](https://www.tracopower.com/products/browse-by- category/find/tri-3/3/)

It's not my field and I had little clue what was happening at the EE level. Maybe you could argue they are not what is normally meant by saying voltage regulators.

<comment><USER9> That's a module, not a chip. If it's one of those 1mm x 2mm sot packages, it almost certainly doesn't have embedded switching capacitors.

</comment></comment></comment></comment></comment><comment><USER10> > Then, you give them a fake schematic of the circuit board, and ask them to > troubleshoot the problem.

> Here's the test: the fake board schematic should be absolutely riddled with > errors. All sorts of errors - errors that you've seen before, errors that > you've heard about before, errors that have thrown your product development > efforts for a loop. These errors should run the gamut of severity

I think you need to communicate to the candidate that this is a board with _a lot wrong_. If you hand me something that looks like a real board made by the organization, and it's of exceptionally poor quality-- panic will ensue. Is there a single issue I'm supposed to point out? Is the interviewer not aware of how bad this is? Do I even want to work at a place producing shoddy work like this?

<comment><USER11> Just give your opinion as you would to a coworker on your best day. That's what any reasonable interviewer is looking for unless otherwise stated. Similarly, you can tell a lot by how your comments are received.

<comment><USER10> "Whoever drew this wasn't just high, they smoked _all_ the crack _everywhere_."

</comment></comment></comment><comment><USER12> I've tried (and abandoned) a similar question suite for Security SWEs. Giving people sample code riddled with security flaws and asking them to explain what was wrong.

I found it difficult in the security domain since so much of it is context dependent (what's the interface? Is this code in the kernel? Are you concerned about speculative side channels?). I also found it difficult to calibrate.

There's probably a good question space in there if I were to spend time testing the questions more, but there are enough other questions in the neighborhood that I've moved on.

<comment><USER13> I agree, the analog isn't a good fit. With EE there's a floor of knowledge that basic "bad schematics" can build off of.

</comment></comment><comment><USER14> Excerpt:

"Need some ideas for a crappy schematic? Here are some easy ones I can think up off the cuff:

o Current limiting resistors missing (BJTs, diodes, etc.)

o Shorting a potentiometer node to a rail

o Voltage regulators missing capacitors at input/output

o Missing pull-up/pull-down resistors on digital buses

o Missing decoupling capacitors

o Powering ADC reference voltages from a switching supply

o Transistors placed in wrong/backwards configuration

o No signal conditioning/buffer for analog signals into ADC

o AC coupling high-pass filter sets corner frequency too high into ADC

o Reset sequence of digital component is wrong

o Antenna is missing a matching network/filter

o Clock/data lines swapped backwards in digital bus

o No pull-up/pull-down resistors on IC configuration pins

o No frequency compensation on unstable opamp circuits

o Improper gain settings on opamp circuits"

Fascinating!

Would love to see a book about these errors and others -- with the title:

"Learn EE (better!) -- by studying things that don't work"

The book could be divided into chapters... Each chapter delves into another way that a circuit can fail, along with an explanation of why, and the correct way to engineer that type of circuit/circuit component... The chapters would be ordered from the most common errors to the less common ones... it would be a great teaching tool for people who wanted to become better at EE...

<comment><USER15> I've never heard of a whole book, but I can see how it'd be a great book if someone really took the time to make it.

I guess you could argue that _The Art of Electronics_ kind of fills this niche. Horowitz and Hill call out a bunch of non-functional or error prone circuits with large, friendly "DON'T DO THIS" labels. The second edition had a great section at the end of each chapter entitled "Bad Circuits" that served just this purpose. (The only flaw with the 3rd edition is that they took out "Bad Circuits", in my opinion.)

<comment><USER16> That's too bad they removed the bad circuits. I found those extremely useful when first starting out. Sometimes my first guess at how to do something was explicitly noted as a bad circuit, which i suspect was the intention. After reading about a new component, students often wonder "can i just do x instead?" and the bad circuits section did a great job of anticipating these kinds of questions.

</comment></comment></comment><comment><USER17> You don't need anything fancy in an interview to figure out someone's competence with circuits. Granted, it depends on what level you're targeting and what specialties you're looking for, but even asking them to draw a schematic of a lit LED may be very telling.

</comment><comment><USER18> >>> Then, you give them a fake schematic of the circuit board, and ask them to troubleshoot the problem.

Is the board built to the schematic?

That's my first question when a board loses its magic smoke.

<comment><USER19> That in itself is a Design for Manufacturing question, involving stack-up, Gerber correctness, and drill tolerances.

</comment></comment><comment><USER20> I love that idea. I always try to be cognizant of the stress thing too. I cannot count the number of times I've given the candidate a problem based on some basic EE or CS concept, only to have them over-think the heck out of it because the answer seemed "too easy."

While its interesting to see what vector their over-thinking takes, it doesn't help move the interview along.

Doing similar examples with code is also good, as debugging is probably a big chunk of the time people will spend on things. And there are various shades of bug from "in your face" like you have an if statement in C or C++ that uses only one = sign, to "subtle" where a local definition masks a global variable, to just plain ridiculous like structure packing alignment issues based on compiler options.

All good ways to see how much of the 'craft' the candidate knows versus the 'facts'.

<comment><USER15> Thanks Chuck. :)

</comment></comment><comment><USER21> I only have a basic level of understanding of EE stuff, but I've been interviewed like this for software jobs, and thought it worked well. Just 1 page worth of code, riddled with glaring errors, subtle errors, security issues, code smells, etc. Naturally, spotting more things and more subtle things faster is good.

</comment><comment><USER22> I had one of these for an interview a few months ago. A huge schematic and I was told to find out "why it wouldn't work". It took me about 10 minutes to figure out that one FET's diode network was set up so that it'd short out and fail, and I ended up failing the interview for taking so long and labeling every subsection. They told me this was a spot test, and this kind of thing should just jump out immediately if you're smart enough. They also said me immediately jumping into the details of each component and its role was a red flag and they didn't think I'd be able to get the big picture of circuit design.

I've been thinking about this since and I don't know how I can fix this. I just don't know any other way to think other than looking at the details. Does their assessment that this is a flaw seem on point?

<comment><USER15> Sounds like the interviewer tried to use this tactic, and did a lousy job of applying it.

1) "Why it wouldn't work" is vague and nonspecific. "Applying power and hearing a pop/smelling smoke" is a big hint. You have to phrase the question in a way that gives up _some_ information for it to be a decent use of time.

2) Complexity fucking kills these interviews. You shouldn't be handing off a multi-page schematic with complex interconnects. Five or six major components, max. Label your subsections for clarity: things like "microcontroller", "EEPROM", "LED driver", "half bridge driver", "ADC", etc.

Sounds like you did the right thing, and got penalized for it. Fuck 'em. They weren't the right fit for you anyway.

<comment><USER22> Ok, to be fair, they did say "when we turned it on, part of it blew up" when I asked for more details, and it was just a 2-page schematic with 6-7 subsections. I think it was pretty fair, I'm just frustrated that it felt like I couldn't solve it by thinking slowly and methodically.

It was a really cool company and I'd have loved to work there. It's the kind of place where I want to be a good fit.

<comment><USER23> I do wonder if this is just a scenario where there's no way to win. The person writing this blog post has exactly the same interview prompt - something went pop when the board was powered up - but they expect candidates to spot subtle things like missing decoupling capacitors that almost certainly aren't the cause of the problem.

<comment><USER15> Just about every person I've used this prompt on has found the prompted error, and then gone on to find a few more. However, I don't really care about the number of errors you find nearly so much as I do seeing and hearing you reason your way through a new problem.

I don't expect you to find all the issues. (But if you do, then congratulations! I'm gonna try to hire you.) I _do_ expect you to talk to me about your thought process when confronted with a novel issue.

That's what good electrical engineers do. They don't _know_ all the answers - they _reason_ their way through unexpected challenges.

</comment></comment></comment></comment></comment><comment><USER24> > _...should be absolutely riddled with errors._

Same applies to code in an interview; it should have syntax, efficiency, correctness errors and more.

<comment><USER18> You should use your own production code. This will kill two birds with one stone: Does the candidate know how to read code? Is your production code readable?

<comment><USER25> I very strongly disagree with this approach.

Suppose a candidate identifies a crucial flaw in your production code but for some reason the hiring negotiations breaks down and can't hire them. What happens next? Do you compensate the candidate for the time and effort to improve your code base?

The interview process shouldn't be a free code review.

I like your idea of testing if they could work with your code base. I just think there are better ways to test for this without getting into potential predatory actions. The only way I see how this could work is that you say: "You'll either get hired or we pay you a bug bounty of X amount".

I might be too cynical but good luck on convincing the higher ups there's a small chance they need to pay candidates if they did extremely well in the interview process because it's "only fair and they did the work".

</comment></comment></comment><comment><USER26> I get that this is intended to be a general exercise in spotting schematic errors. But as someone who brought-up and debugged numerous complex power supply boards for mobile electronics, it seems to me the most important and useful bit of information is missing from this exercise: show me where the smoke came out!

<comment><USER15> I considered including the actual one page PDF I use for interviews in the post, but I didn't want to chance someone finding it online before they came into an interview with me.

But yes, the central point of the exercise is "show me where the smoke came out!" (It's a very, very dumb mistake. Nearly everyone I've spoken to has reasoned their way to it.)

The rest of it is to let people demonstrate what other errors they can pick out, or serve as fallbacks for the folks who don't find the magic smoke/component death failure.

</comment></comment><comment><USER27> Here are some of my RF specific interview questions. Spend no more than 1 minute on each.

Power Amplifiers

Q: Where do GaAs/GaN FETs DC gate currents originate, and why are they positive and negative?

Q: How would you temperature compensate the transistor DC bias.

Q: What is AM-AM and AM-PM distortion and how would you measure it?

Q: Give an example of a "memory effect".

Passive RF/Microwave Circuits

Q: How would you measure unloaded Q of a resonator?

Q: What is self-resonant frequency of a component (i.e. chip L or C) and when is it useful.

Q: Why does a stripline coupler typically perform better than microstrip?

Q: What's the characteristic impedance and electrical length for the lines in a 2-way Wilkinson splitter.

Q: Where does the current flow on a microstrip line and its return path?

Test and Measurement

Q: What's the difference between RBW and VBW on a spectrum analyzer?

Q: When is a sliding load used in VNA calibration and how does it work?

Q: What does noise marker mode do on a spectrum analyzer?

Q: How would you measure a SMT part at several GHz with proper reference planes?

Q: What's a quick way to tell if your spectrum analyzer is contributing to IMD3.

Digital Comms

Q: Why are RRC filters used so frequently?

Q: Describe the flow of PSK receiver?

Q: What is an Error Vector Magnitude (EVM) measurement?

Q: What effect does clock jitter have on an ADC or DAC.

Q: Would a class C amplifier work better with OFDM or FSK?

Antennas

Q: What typically limits the bandwidth on a single frequency patch antenna?

Q: What's common mode radiation on a coax (to antenna) transition and what are a couple of ways to minimize it.

Q: What happens to an antenna's input impedance and directivity when you move it very close to a "ground plane".

Q: What's an IFA or PIFA antenna and how does it relate to a monopole; why are they so common in compact devices.

Q: Given a VNA and two linearly polarized horn antennas with known gain, how would you measure the gain of a circularly polarized antenna?

RF Front Ends

Q: What are the typical blocks in a superhet receiver (or down conversion chain)?

Q: What typically determines diode mixer linearity?

Q: What's IMD?

Q: What's more important in LNA; noise or impedance match?

Q: What's cross-modulation?

Synths and Oscillators

Q: What are the advantages and dis-advantages of a Frac-N over an Integer-N synth?

Q: What specs would you look for in a linear regulator to isolate a synth analog section from a switching supply?

Q: Given you don't care about settling time, how would you set loop filter bandwidth to achieve best noise performance?

Q: Given you don't care about settling time, how would you set loop filter bandwidth to achieve best noise performance?

Q: What do synth ICs have charge pump trim settings (i.e. upper and lower different gains)?

Connectors and Waveguides

Q: What is skin effect?

Q: What is the torque specification for a 3.5mm connector?

Q: Why is nickel used in plating processes? What effect does it have on RF?

Q: What's the highest frequency that an SMA connector can be used for TEM propagation? What happens above that?

Q: If you needed to slice a rectangular waveguide in half, would you slice down the broad wall or the narrow wall? Why?

Simulation

Q: Why would use you use 2D thick metal (or 3D EM) on edge coupled lines? Is there a rule of thumb?

Q: Would you use harmonic balance or transient simulation (or both) to model a simple diode detector?

Q: What are some quick methods to determine if your EM simulation is plausible?

Q: Given microstrip element models, would you model a short, wide line as a line with two steps, or a cross with two long stubs; the layout is identical.

Q: What type of EM simulator (2D or 3D, infinite or finite boundary, gridded or gridless, time or frequency domain) would you use for: patch antenna, planar filter, horn antenna, cavity filter. Why?

<comment><USER19> Dude, I work in RF and it would take me more than a minute to remember some of the answers to these questions.

</comment></comment><comment><USER28> Analog will be gone in the next few years. EE is the new technology for the future

</comment><comment><USER29> Sorry but this is probably terrible. Without knowing the part datasheet this interview isn't going to tell you much. I think it's much better to focus on signals/systems plus some circuit level problems that focus on the basics; open drain outputs, op-amps, RC/RLC circuits, transmission lines etc...</comment>


Reaction to Windows 8 RC: This is worse than I thought - <AUTHOR> http://blog.assarbad.net/20120601/this-is-worse-than-i-thought/

<comment><USER2> I still think Windows 8 is the base foundation for Windows 9, much like Windows NT was the base foundation of Windows 2000 and then XP.

</comment><comment><USER3> Who else thinks that Metro on the desktop is the new Vista?

</comment><comment><USER4> 3 words: U bun tu

<comment><USER5> Sorry to flog this horse some more, but Natty was the Windows 8 of Ubuntu. I like the 3-letter option better.

<comment><USER6> DOS?</comment></comment></comment>


DropIt – A file uploader built with Node.js - <AUTHOR> https://github.com/ThalKod/DropIt <comment><USER2> I personally prefer [https://send.firefox.com/](https://send.firefox.com/) as they also encrypt the files.

</comment><comment><USER3> I notice this interface is a copy of [https://uploadfiles.io/](https://uploadfiles.io/)

Is this code released by them, or simply a clone of their site? I used uploadfiles.io until last year when they started implementing a countdown timer on downloads, and haven't used the service since. However I did find the interface and usability quite nice, so this is a perfect alternative to host my own.

<comment><USER4> Definitely just a clone. If you're looking to host it, though, I'd recommend Mozilla Send: [https://github.com/mozilla/send](https://github.com/mozilla/send)

(Here's an example: [https://send.firefox.com/](https://send.firefox.com/))

</comment></comment><comment><USER5> See also discussion about "F*EX (Frams' Fast File EXchange)" from a week ago

[https://news.ycombinator.com/item?id=17210537](https://news.ycombinator.com/item?id=17210537)

</comment><comment><USER6> There is also [https://github.com/oftn-oswg/zerodrop](https://github.com/oftn- oswg/zerodrop) which supports expiry and blacklists with geofencing.

Info: [https://eligrey.com/blog/zerodrop/](https://eligrey.com/blog/zerodrop/)

</comment><comment><USER7> I built something similar that would make the deletion process seamless. The uploaded files are stored in memory and never hit the disk. They then get automatically deleted when the user leaves the site.

Let me know what you think: [https://tempd.link/](https://tempd.link/)</comment>


Website featuring only the highest rated Amazon items - <AUTHOR> http://www.alltoprated.com

<comment><USER3> I was browsing for a rice cooker just yesterday and I wanted to find the most reviewed and highest rated item which proved to be quite a tricky task - <USER2> only it worked for amazon.co.uk

</comment><comment><USER4> I like the Idea that more items will be displayed and maybe also a section for recommended books "must reads"

</comment><comment><USER5> This is nothing more than a SPAMMY Amazon Affiliate site.

Flag this down.

<comment><AUTHOR> It's top rated stuff on Amazon, what did you expect? What does it matter if it has affiliate links anyway?</comment></comment>


Ad For Color Features Guy Stalking Girls In a Bikini - <AUTHOR> http://thenextweb.com/shareables/2012/01/13/this-commercial-for-color-made-me-feel-creepy-by-just-watching-it-video/ <comment><AUTHOR> Color is getting desperate and creepy.</comment>


The psychopathology p factor: will it revolutionise adolescent psychiatry? - <AUTHOR> https://onlinelibrary.wiley.com/doi/10.1111/jcpp.13063 <comment><AUTHOR> The full title, which is far too long for HN's 80 character limit, is "The psychopathology p factor: will it revolutionise the science and practice of child and adolescent psychiatry?".</comment>


Comparing Wearables: Fitbit Flex vs. Jawbone Up and More - <AUTHOR> http://allthingsd.com/20130715/fitbit-flex-vs-jawbone-up-and-more-a-wearables-comparison/?mod=tweet&utm_content=buffer555b4&utm_source=buffer&utm_medium=twitter&utm_campaign=Buffer

<comment><AUTHOR> It's slightly ironic that these $100-$199 devices are compared using a $30 pedometer as the gold standard.</comment>


The New Face of CyanogenMod.org - m-r-a-m http://www.cyanogenmod.org/blog/the-new-face-of-cm-org

<comment> m-r-a-m I'm glad they got rid of the useless devices page. The previous version only listed some of the supported devices and most of them were several years old. The new link takes you directly to the wiki, which provides lots of helpful information.</comment>


Shield, A Security-Minded PHP Microframework - <AUTHOR> https://github.com/enygma/shieldframework

<comment><USER2> It seems that Chris is just introducing this project to the community. Maybe there are flaws, I admit that I'm not the best one to judge that. But to focus on those flaws seems to miss the point.

Chris is trying to build a PHP framework where security is the prime consideration. To my knowledge, a project like this doesn't exist already. This is an open source project, and by Chris's own admission, a learning experience. This is an opportunity for the PHP community to have a discussion that is centered around the best way to solve the myriad of security issues that plague PHP frameworks and applications. The knowledge and experience generated from this project can be used to the benefit of other frameworks and applications in the PHP ecosystem.

I applaud Chris from undertaking this effort to challenge and improve his knowledge of web application security in a public way so that others may benefit from his experiences.

And shame on those who are trying to kill this project with negativity and condescension before it even starts.

</comment><comment><USER3> While I'm not a PHP fan, I sincerely wish the average web developer were more security conscious and so I applaud the effort here. Having been the grouchy security guy on more projects than I can remember, I can attest that it's a thankless and tiresome job. The better you do, the less it will be appreciated.

</comment><comment><USER4> > Filter values based on filter types (supported are: email, striptags)

Striptags is not a security tool, it is a presentation tool.

> Output filtering on all values (preventing XSS)

I'm still trying to figure out how you've implemented this.

<comment><USER5> Here is the escaping :

[https://github.com/enygma/shieldframework/blob/master/Shield...](https://github.com/enygma/shieldframework/blob/master/Shield/View.php)

at this line :

$value = htmlspecialchars($value);

<comment><USER4> That could do with being mentioned in the README, a large part of the problem with PHP is developers not knowing what method to use to sanitise strings. After seeing striptags mentioned explicitly, I expected the worst.

<comment><USER6> He used DES for session security.

That's the worst.

<comment><USER4> [https://github.com/enygma/shieldframework/commit/44d9fc7e981...](https://github.com/enygma/shieldframework/commit/44d9fc7e9814f18f184c19a7858f831d1f01962c)

</comment></comment></comment></comment></comment><comment><USER7> Before anyone else brings it up, there are some issues with the session handler function. I'm working on a write-up and pull-request for them to fix the broken cryptography used there.

<comment><USER6> That's the least of the problems here.

Not every library can be saved.

<comment><USER8> I think it is possible to fix the DES thing without tearing the rest down...

</comment></comment></comment><comment><USER6> Yes, let's all use a security framework by a guy who thinks DES is a good choice, and who openly admits that this is a learning experience for him, this security framework he's giving to others.

Clearly, if after it's pointed out that DES is a bad idea he still doesn't know why, but he also refuses to fix it or take it down, the rest of this should be trusted too.

<comment><USER7> Where did he refuse to fix it? I'm confused. I've talked with him directly, and we're in progress on a complete fix for that issue (the cryptography issues in the session class)...</comment></comment>


Female scientists mock Nobel laureate with photos - <AUTHOR> http://www.washingtonpost.com/blogs/worldviews/wp/2015/06/11/trouble-with-girls-female-scientists-mock-nobel-laureate-with-distractinglysexy-photos/ <comment><USER2> >"Three things happen when they are in the lab. … You fall in love with them, they fall in love with you and when you criticize them, they cry."

Nowhere did he say they were "distractingly sexy". He said men fall in love with women. That happens. He also said women fall in love with men. That also happens. If it didn't, the human population would be declining and not increasing.

His only sexist statement is that they cry (with the caveat that you criticized them). It's very ironic they are crying on Twitter - no less about something he never actually said.

<comment><USER3> > Nowhere did he say they were "distractingly sexy". He said men fall in love > with women. That happens. He also said women fall in love with men.

Also, men fall in love with men, and women fall in love with women.

> It's very ironic they are crying on Twitter

Uh, "mocking" is very different from "crying".

<comment><USER2> >men fall in love with men, and women fall in love with women.

He didn't say that.

>Uh, "mocking" is very different from "crying".

With the above correction you've shown your political standing. Of course you see it as mockery. Most people are going to see it as them crying about his "sexism" over something he didn't actually say (that they were distractingly sexy).

If people were mocking him - more men would be mocking him for the second statement that they are "irresistible" to women and their bravado gets them all the ladies and they are having troubles working because of all the sex they are getting. But they aren't crying on Twitter because he said that women fall in love with them.

<comment><USER3> > If people were mocking him - more men would be mocking him for the second > statement that they are "irresistible" to women

The offensive part that is being mocked was not the description that women fall in love with men or vice versa.

The offensive part was that _both_ of those were described by Hunt as parts of his "problem with girls...when they are in the lab".

That is, Hunt says:

1\. Women fall in love with men (implicitly, to the detriment of the function of the lab) => problem with women

2\. Men fall in love with women (implicitly, to the detriment of the function of the lab) => problem with women

<comment><USER2> >"problem with girls...when they are in the lab".

This can be read two ways depending how you parse it.

That is, Hunt says:

1\. Women fall in love with men (implicitly, to the detriment of the function of the lab) => problem with coed labs

2\. Men fall in love with women (implicitly, to the detriment of the function of the lab) => problem with coed labs

<comment><USER3> Your reading of "the problem with girls...when they are in the lab" requires the sexist assumption that the default state of labs is to include males, such that that a "problem with coed labs" is a "problem with girls...when they are in the lab", because, obviously, there's always going to be men in a lab.

So, either reading is sexist, though it is true that there are different ways in which it can be sexist.

</comment></comment></comment></comment></comment></comment><comment><USER4> I hope this isn't taken the wrong way, but I'm glad he's not taking it all back and saying he didn't mean it. Not that I support his position, but I do appreciate him not pretending that a bunch of people making fun of him on twitter suddenly changed his mind he's spent 72 years making up.

<comment><USER3> > I do appreciate him not pretending that a bunch of people making fun of him > on twitter suddenly changed his mind he's spent 72 years making up.

Well, I guess I appreciate him not _pretending_ to have reconsidered after the public response, OTOH, I don't know why one would appreciate someone not _actually_ reconsidering such a position.

I fail to understand how, as often seems to be the case with issues like this, people respond with an attitude of "well, sure, he's got a horrible position, but at least he stubbornly refuses to reconsider it even when large numbers of people point out how horrible it is".

<comment><USER5> He's British?

</comment></comment></comment><comment> jack-r-abbit FTA: Hunt reportedly said: "Let me tell you about my trouble with girls. Three things happen when they are in the lab: You fall in love with them, they fall in love with you, and when you criticize them they cry."

Has anyone stopped to consider that he may have been talking about trouble _he_ has actually experienced? He does say " _my_ trouble..." not " _the_ trouble...". Later, he went on to clarify that he has fallen in love with someone and someone has fallen in love with him. If those actually happened and they were trouble for him, then his statement is accurate. He didn't comment any more on the crying part but it doesn't sound implausible that he, at one point, criticized a woman and she cried.

<comment><USER3> > Has anyone stopped to consider that he may have been talking about trouble > he has actually experienced?

If one assumes (and I don't think that his subsequent clarifications are consistent with this interpretation) that his intent was to merely relate personal experience without generalizing further from it, then the whole affair provides a valuable lesson about why one should be precise in one's use of language and avoid using the second person ("you"), especially in a context where it might be readily be viewed as intended in its generic sense (in which it is equivalent in definition, though less formal in tone, to "one"), when one intends the first person ("I").

OTOH, I don't think it works.

> Later, he went on to clarify that he has fallen in love with someone and > someone has fallen in love with him.

"People" (plural) in both cases, but what he did not say when he did so as part of his mixed apology/defense of the statement was that anything indicating that he did not intend to generalize beyond his personal experience.

> He didn't comment any more on the crying part

He did, in fact, in the same apology/defense. [0]

[0] [http://www.bbc.com/news/uk-33077107](http://www.bbc.com/news/uk-33077107)

<comment> jack-r-abbit See? I guess I wasn't clear enough. I meant to say: He didn't clarify if making a woman cry was a generalization or something that had actually happened to him (like the falling in love part). But yes, he did speak to it further in the context of "you need to be able to criticize people without them crying."

An equally valuable lesson is if something can be taken different ways, make sure you are taking it the same way the other person meant it. He didn't say it was or was not a generalization. He didn't say it was or was not only personal experience. Everyone just made their own assumptions.

<comment><USER3> > An equally valuable lesson is if something can be taken different ways, make > sure you are taking it the same way the other person meant it.

In English, you can be specific or generic, but it can't mean "I and only I".

Your suggested "interpretation" is a radical rewriting that even Hunt's own apology/defense doesn't offer, it just offers experience as the _basis_ for the generalizations.

<comment> jack-r-abbit > you can be specific or generic

Well... there you go. I thought when you said "you" you were specifically referring to me. But then I reread it and it turns out you were saying "[the word] you." English is a pretty complicated language. No wonder we're always pissing each other off. (Edit: "we're" was not meant to refer to specifically you and I. It was a more general "we as a people."

</comment></comment></comment></comment></comment><comment><USER6> I'm tired of this stupid culture war. I'm tired of the attention seeking and the moralizing. It's an endless, pointless distraction.

<comment><USER7> It's not a pointless distraction to women who want to pursue a career in scientific research, but will be limited to excluded just because they are women.

</comment></comment><comment><USER8> How exactly is this effort supposed to demonstrate that Hunt is wrong?

<comment><USER2> It's the opposite. They're proving him right.

Most of the offense seems to be taken on his first statement: "Men fall in love with women." Twitter 3rd-wave Feminists twisted that into "too sexy for the men".

You don't see any men going on Twitter complaining he called them irresistible and distractingly sexy (things he never actually said anyway). Where's all the offence taken that "Women fall in love with men" from the men?

Them crying on Twitter about something he never said (and he said about both genders, not just females) kind of proves his 3rd point: they cry.

<comment><USER3> > Most of the offense seems to be taken on his first statement: "Men fall in > love with women."

I think you are confusing the which element of the whole sexist set of statements is the main inspiration of the mockery directed at the whole set with which is the main focus of _offense_.

Though, to be fair, both the "you fall in love with them" and the "they fall in love with you" statements are worthy of offense when _both_ are offered as part of the explanation of his "trouble with girls...when they are in the lab". (Both presume that the "natural state" of a lab is to be full of men, so any complications that arise from a mixed-sex environment are a "problem with girls".)

Of course, unless his "problem" is pedophilia, compounding that by referring to _women_ as "girls" when discussing the "problem" he has with them in the lab compounds this further.

<comment><USER2> Fully grown women also refer to their female coworkers largely as "girls". Guys do not refer to men as "boys". They don't use "men "either. They use "guys".

Girls seem to dislike the feminine linguistic equivalent to "guys", which is "gals" seeing as they infrequently use it themselves to refer to themselves. However, they refer to themselves as girls quite frequently. I've been told several times in my life to stop using "gals" when referring to a female group because _they disliked the word_.

Guys have "guys night out", they don't call it "mens night out". Girls have "girls night out". They don't call it "gals night out". For all intents and purposes - "girl" does not always refer to a young female; context is important.

In Japanese おばあさん can refer to "aunt" or "middle-aged woman" and the _context_ it is used in is important. Your aunt could really be a 6 year old girl. Why are you calling her a middle-aged woman? You aren't. You're calling her aunt.

Similarly, for English, "girls" has become the equivalent of both "guys" and "boys" and depends on context in which it is used.

Feel free to suggest an alternative to "gals" \- but I'd consult with "the girls" first. They seem to have settled on "girls" themselves, but what do I know?

<comment><USER3> > Fully grown women also refer to their female coworkers largely as "girls".

Sometimes, some of them do. Context matters, still, and one place where this is very rare -- for the same reason that it is very common for women to object when other people do this -- is in discussions of professional performance. And, in another sense in which context matters, what might be unoffensive -- or only mildly so -- on its own can be more offensive when it is compounding an already-sexist set of statements.

> Guys do not refer to men as "boys".

IME, sometimes they do. (It may not be particularly common in the dominant -- i.e., white middle-class -- subculture, but there certainly are subcultures in which, e.g., referring to an adult male's adult male associates as his "boys" is not uncommon. And it would still be compound the offense to use the same term for adult male members of that subculture when making an otherwise-racist set of statements.)

> Feel free to suggest an alternative to "gals"

In the context of the statement Hunt was making, the obvious choice that would not compound the already sexist nature of his remarks to refer to adult female humans would be "women".

</comment></comment></comment></comment></comment><comment><USER9> What an incredibly _petty_ thing to do.</comment>


Why the Library of Congress cares about archiving our tweets - <AUTHOR> http://arstechnica.com/tech-policy/news/2010/04/why-is-the-us-govt-archiving-your-tweets-we-ask-them.ars

<comment><USER2> For those interested, I asked around and it looks like the entire Twitter collection is only going to be 5TB worth.

<comment><USER3> I calculate the tweets data must be around 3.5TB so that figure seems about right (if you throw in user and times tamp data)

</comment></comment><comment><USER4> I hope they do elect to store the actual URLs when URL shorteners are involved. Really, though it would eat a hole in the URL shorteners' business, I really think sites like Twitter should be dynamically 'fixing' those links before inserting them into the database.

</comment><comment><USER5> I've been curious. Does this include the tweets of "private" accounts?

<comment><USER6> The article mentioned that only public accounts would be included.</comment></comment>


Show HN: Please review my MVP: Quill.org (Interactive Grammar Web App) - <AUTHOR> http://www.quill.org
We are a nonprofit organization, and Quill is a free, open source tool. We are looking for feedback on our user experience and our code optimization. Critical feedback is appreciated.
If you'd like to check out the code: https://github.com/empirical-org/quill <comment><USER2> This is a neat web app and I liked it. However, it is asking me to sign up after finishing the initial test. Why not give me few more tasks to do, let me know what areas should I improve and then ask for if I am interested to register/sign up. It will be great if the exercise offers single sentence with one or two grammatical error/s instead of a whole paragraph. But anyway I believe it is a great start and heading towards right direction. Thank you guys for such an awesome Web App. I will register and go through it more and will provide your periodic feedback.

<comment><AUTHOR> Cool, thanks. We are thinking about doing a 5 minute guided tour through the site now so that we can show off the entire experience before asking for sign up. It'd be great to get your feedback on it once it is up.

</comment></comment><comment><USER3> Tried it out, seems cool. Question aside from the app, what is the purpose of your non-profit and how are you funded?

<comment><AUTHOR> We are funded by the Gates Foundation. We intend to become a commercial nonprofit and charge for lessons (a freemium model of 1,000 free lessons). We are a nonprofit as we'd like to develop a model of crowdsourced content creation. Being a nonprofit signals that this content isn't going towards making us rich. We are still working out this model, and in the EdTech space there are a couple of foundations that make this possible.

</comment></comment><comment><USER4> If you haven't seen No Red Ink (noredink.com), you should check it out. They do something similar.

Best of luck!

<comment><AUTHOR> Yep we know about NoRedInk. We differentiate ourselves by focusing on learning by writing, rather than multiple choice questions. We're also taking a different approach to content development by being open source and open content. All of our content is reusable under a creative commons license.

</comment></comment><comment><USER5> I like it! And thanks for putting the code on GitHub too.

<comment><AUTHOR> For sure! We are an open source project, and we'd appreciate the help from Rails developers looking to contribute.</comment></comment>