Designing cities to counter loneliness? Let's explore the possibilities - <AUTHOR> https://theconversation.com/designing-cities-to-counter-loneliness-lets-explore-the-possibilities-104853 <comment><USER2> Okay, I have hosted adult Dungeons and Dragons games for many years, a pursuit that's as close to individuals common together again loneliness as one gets. Trying to find areas for small groups to use for this and other things peaked my interest in the organization of cities to encourage or discourage individuals coming together.

Effectively, I think the structure of American cities have always been designed fundamentally to decrease togetherness outside of churches and hence today increase loneliness. The basic principle since the puritan arrived has been that an idle people gathered together were a danger. Hence laws against vagrancy and idleness, the non-existence of anything like the promenades of European cities, the prohibition of alcohol and later marijuana and so-forth. The Occupy movement of several years ago, for a further example, was ended merely by enforcing all of the existing against camping, loitering, disorderly conduct and so-forth [1].

Today, rent is so high and homelessness so prevalent that any location that allows people to mill about freely is going entice homeless to sleep and hence will attract repression.

There are locations calling themselves "community centers". They only rent their common rooms for $25/hour or more, an amount that makes it impossible for most informal, average individual to afford.

[1] [https://en.wikipedia.org/wiki/Disorderly_conduct](https://en.wikipedia.org/wiki/Disorderly_conduct)

<comment><USER3> So, slightly unrelated, but how does one go about finding a D&D group in a new city?

<comment><USER4> Game stores

<comment><USER2> Either local games store or meetup.com

</comment></comment></comment></comment><comment><USER3> As an adult, I've only really ever had an active social life for one short period where I was barely surviving as a retail wage slave. My coworkers were all in the same situation, but we found solace in our shared misery, and I made a lot of really good friends.

As a programmer, I sometimes make friends with my coworkers, but it's a very sanitized sort of interaction. Genuine exchanges of ideas is a dangerous proposition when it means risking our livelihood.

The only place where I can freely exchange conversation with strangers is, ironically, on wild backcountry trails. Out there, information is very important. How much snow is there on the ridgeline? Where is the next water source? Any good campsites? And so on.

I've come to believe over the years that friendship can essentially be distilled down to proximity + a common interest + time. Unfortunately, we spend most of our time working, and these three things are very difficult to find outside of the workplace.

<comment><USER5> I commute between New York and the Bay Area. It is so hard to strike up a meaningful conversation with a stranger out west.

And it's not just New York. In most big cities, I can reliably find an acquaintance after a few hours at a restaurant, bar or museum. But the Bay Area is so reticent. The closest comparison to it I can think of is the Middle East.

<comment><USER6> I 100% agree with you. I've lived in the Bay Area 31 years, and I usually drum up this scenario:

Sitting alone, at a nice bar, anywhere in the Bay Area - I could sit there all day, and no one would say a word to me.

Any other city? Even New York? Boston? Austin? Atlanta? Denver? Paris? Berlin? Seattle? No problem. Someone will chat, I'll meet a group, whatever.

Also, I'm extremely social. It's "not me."

Disclaimer: Just an unscientific observation.

<comment><USER7> In SF, I feel people have moved to the city with their own clique that they try to stay within - people will show up to meet their group as part of their evening plans, not to meet new people. They're open to it, but never proactive.

However, the odds improve if you avoid "nice" bars - destination bars are a thing, people show up with their group for a few drinks never intending to visit again. They never socialize so locals go elsewhere.

</comment></comment></comment></comment><comment><USER8> Shameless self plug, but relevant: a few years ago I did a test of the association between spatial layout and community cohesion which came back positive for a number of network analysis measures on two different data sets.

[https://ij-healthgeographics.biomedcentral.com/articles/10.1...](https://ij- healthgeographics.biomedcentral.com/articles/10.1186/1476-072X-13-11)

tldr (refined and simplified with a few years hindsight): more walkable neighbourhoods = better

<comment><USER3> What are your thoughts on cities which outlaw cars entirely?

<comment><USER8> My (non researched) opinion on this one is that most westerners find cars useful, hence car free development risks creating a district populated only by people who can't afford cars. Segregating people in that way that is going to cause other problems, it happened before in the uk when planners decided it was a great idea to knock down aging buildings and replace with tower blocks of cheap flats.

That said I do think we need to challenge our assumptions about the role cars play in society. It is assumed that highways are for cars primarily and this needs to be reined in somewhat.

Car free development might work in places where there is already a sizable wealthy demographic choosing to live car free e.g. London.

As to whole cities going car free, are there any? Not something I've looked into, would be interested to know.

<comment><USER9> Has nothing to do with wealth and everything with zoning laws. If there's mixed use, enough density to justify good public transport then cities without cars thrive (just like they did before cars were invented).

Your "observation" outs you as someone that spent most of his life in the US where most cities were designed around cars. US cities are awful, by the way.

Imagine this: a bunch of folks come to a completely unexploited continent, rape and pillage until they ran out of land and then proceeded to create one of the most unhealthy societies ever.

It's easy to be economically successful when there's tons of resources and nobody to share them with, the true measure of a society it's how most of their people live: without public healthcare, no welfare protections, lonely, stressed out, sicker than their european counterparts.

<comment><USER8> You're right that Euro style compact cities are better than urban sprawl, though plenty of people still own cars in them, and those who don't still benefit from the option of doing so should they choose. I'm not saying it can't work at all, I'm saying there is a risk of unintended consequences if you take that option away, and that risk should be considered/managed.

Your rant against the US, while it has some merits, is misdirected at me; I have lived in Europe all my life and cycled to work for around 20 years (alas no longer). Perhaps my post outs me as someone who grew up in a rural area in a country that invests poorly in public transport (1 bus per day to the village, how's that supposed to work for shopping?) and as an adult I have hobbies which require transporting equipment to remote locations (e.g. mountain biking, mountaineering, performing musician). I can't see myself enjoying the well being benefits those things bring me and my family without regular ability to drive a car to our door.

</comment></comment></comment></comment></comment><comment><USER10> I think a lot of colleges do a good job of fighting lonliness. Colleges have to worry about stressed students, overworked students, mental health issues, suicide rates, because parents pay a ton of attention to these things.

As a result, I think a lot of elements of campus life are things that adults could borrow from to improve their own quality of life.

<comment><USER11> I'm curious what would happen if municipalities tried to become like universities:

\- City sponsored interest clubs (over 300 and it only takes 10 people and a sponsor to start one!!!)

\- City created dining halls in every neighborhood within a 10 minute walk where one pays a reasonable rate to eat there - heck even do a privatized model so cooks can consider creating one where they get subsidies per person, some sort of revenue split, and one of the only requirements being to have a "dining hall" style eating area that encourages social interaction. This could even be folded into food assistance programs where people can go and eat at these for a reduced price.

\- City government health clinics for easy referral and access (Boston actually has a somewhat comparable model to this, I'm sure others do too, but listing it because it feels like a college thing)

Let's go with those three for now. The questions:

How many people would live here? What percentage local tax would they accept to fund this?

I think this is actually a really interesting road to go down.

<comment><USER12> > _City created dining halls in every neighborhood within a 10 minute walk > where one pays a reasonable rate to eat there._

Why would the city do this? It sounds like you're describing the Golden Corral. In any case, if you can demonstrate that people will regularly show up to an open-plan cafeteria to socialize then let's forget about changing local government (which is corrupt and inefficient) and start this restaurant ourselves.

<comment><USER11> Eh I'm not saying it's perfect but I think a few pieces are missing from your version:

\- The government subsidized price to make it a low enough cost because it's certainly can't be as expensive as a golden corral

\- The incentive for a private restaurateur to want to open one of these

This is where the government can actually help make something, which could be funded by a reasonably modest tax if people were willing to pay it.

> changing local government (which is corrupt and inefficient)

All the more reason to work to change it IMO. I bet part of the reason it gets corrupt so easily is because few actually care given how little it really does for them (when the essentials like trash are on autopilot and many other issues don't affect the average resident that directly). While not without its risks and complications, a more involved local government can also mean a more politically aware and involved base of citizens. If a city actually did all these things, local policy changes would actually have a bigger effect that residents would care about.

This is all a very rough draft, I'm sure there are plenty more holes in this. But I think it would be interesting to spend some more time ironing it out.

<comment><USER13> so the restaurant will be funded mainly on taxes of the people living in this city instead of the food itself? Like some sort of all inclusive resort or cruise?

Will citizens take out loans to live in the city just like college?

<comment><USER14> Admittedly I'm not from the US , but regardless I get the feeling that you might be seeing government subsidies for public services as more bizarre and infrequent than they actually are.

Does public transport ever get subsidized at the local government level in the US? Would this make the idea of catching a subway or bus as bizarre to you as the idea of taxpayer-subsidized community food halls?

<comment><USER12> Depending on which city you live in, catching public transportation can be pretty bizarre.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> One interesting thing I noticed when I was living in the middle of nowhere on a 5 acre parcel: I knew all of my neighbors. I'd encounter them on a regular basis and would have meaningful conversations with them. People would help out when needed, I had all their emails and phone numbers.

When I'm living in the suburbs or in a big city, meaningful contact with neighbors is fairly nonexistent.

<comment><USER16> Great. One of the things I noticed when living in the country is I had virtually no interaction with my neighbors. Now in the city I interact with my neighbors all the time (maybe to the point of irritation).

Perhaps the difference in our experience is explained by small sample size & not systematic differences...

<comment><USER3> There is a threshold beyond which you have to know your neighbors in order to survive. Some of my earliest memories are riding my neighbor's snowmobile down the side of a mountain with my parents to buy groceries.

Obviously this is not a situation which most rural dwellers will find themselves in.

</comment></comment></comment><comment><USER17> > "sensory experience cabins".

Wut? Just move life (back) to the streets.

Loosen regulation of street food, introduce outdoor stalls where you're encouraged to eat with strangers by design, grant licences to allow places stay open later and pedestrianize all the things.

Try spending time in Bangkok or Ho Chi Minh city/Saigon and feeling lonely. It's near impossible. Day and night is a sea of mostly friendly humanity because life is primarily lived outdoors.

Sadly, in the West we've made this abnormal (although the climate doesn't help). Our real-life is atomised. There is no third place†. And the online world we retreat to is increasingly drenched in pointless conflict. Kinda bleak.

Lawrence Osborne puts it nicely:

> _Anyway, I think that's one of the attractions of Bangkok. It's not just > f—king. It's just the fact that you're in contact with other people...the > street makes you feel like you're back in the human race, and alive again. > Last night I went for the first time to the store called Whole Foods in > Union Square. And there was this enormous line and it was like 1984. Every > line was being called out by number in this soft automated female voice. It > felt like being squeezed through a tube of toothpaste. It was so > horrifyingly anonymous. And I was standing in this line thinking, I don't > like this. I wish I could be back in Bangkok and be treated like a human > being._

† [https://en.wikipedia.org/wiki/Third_place](https://en.wikipedia.org/wiki/Third_place)

</comment><comment><USER18> IMO it's not the issue of the city. It's the issue of the living space. Humans were originally hunter-gatherers that lived in tight knit tribal communities with intimate shared spaces. Any living style that deviates from this will induce loneliness.

To eliminate loneliness you must form tribes. To form tribes you must produce settings that promote tribal gatherings. In essence this means intimate shared living spaces with medium sized groups of people. The keyword is "medium- sized" humans are not use to living with huge urban shared spaces where the people you see on the street everyday are different.

<comment><USER19> I prefer lonely than forced interactions upon which I have no choice but to depend on for survival.

<comment><USER18> Gotta choose the right tribe. Bonds are usually formed through forced interactions. You have some choice but it's limited.

Few people have the power to be friends with anyone they want. I wish i could be friends with Bill Gates or Elon Musk, unfortunately it's outside of my abilities.

</comment></comment></comment><comment><USER20> Block social media, people would look up from their cell phones. Block map sites, people would ask others for directions. Block movie streaming sites and people would get to the cinema more often.

The thought is that technology replaces human interactions and that is not always good because it might lead to less people to people communication.

Religious services also made people come together in the community but nowadays people are less religious.

<comment><USER21> [https://imgur.com/gallery/WkHHpZ1](https://imgur.com/gallery/WkHHpZ1)

But seriously, even if you consider phones as more distracting than papers, well keep in mind that many people in cities just don't want to be talked to, especially not on their daily commute or what not. I mean, try striking up a conversation with someone on the Tube when in London. They'll probably look at you as if you're mad, and that's been the case for decades.

Hell, they even tried that recently, and people weren't having any of it:

[https://www.citylab.com/life/2016/09/tube-chat-no-thanks- say...](https://www.citylab.com/life/2016/09/tube-chat-no-thanks-says- london/502247/)

Makes me wonder if large cities/groups in general kill conversations and people's interest in being social more than anything else.

<comment><USER22> this is funny because chit chat is generally very welcomed on the nyc subway (and practically everywhere else), especially on the weekends when you can talk to tourists and give directions and have nice exchanges. Obviously rush hour isn't a great time to chat but otherwise tons of people just love to talk about anything, anytime. It's highly contrasted to how very very reserved everyone is in Atlanta (my current home) and almost every other US city outside of new york.

<comment><USER23> I have lived in NYC for more than three years and feel like I've probably only seen a conversation between strangers maybe 5-15 times ever? I take the L and NQRW the most, perhaps this is a hyper-local phenomenon with your line?

I do see the 'tourist asks if they can get to ___ on this train' conversation but don't really consider that in the context of the OP.

<comment><USER22> It's up to you to make a pithy observation + smile or comment on the weather or give up your seat + say hello. Make the subway you want! I rode the A/C & 1/2/3 mostly, fwiw. West side manhattan is just friendlier I guess ;)

</comment></comment></comment></comment></comment><comment><USER24> For me, practicing pick up was an amazing way to find friends and develop new relationships. After watching a bunch of RSD videos I started regularly going out to clubs and approaching girls. As a nerdy and socially awkward guy I didn't end up being a very successful "pick up artist" in terms of getting laid a lot, but I've met some amazing women who ended up introducing me to their friend groups, and that helped me to meet a lot of really cool people and find friends.

Besides, RSD community itself has local meetup groups, so you can find wingman buddies to go out with, and I've met a few great guy friends that way, I know pick up community gets a horrible reputation in modern culture, but the people I met were really smart, cool, and were, like me, into personal development and practicing social skills.

If you can look past the stigma, pick up is an amazing way to meet new people proactively, it's challenging (approaching new people is scary), but fun, free, can be done at any time, and the results depend on how much you practice. I highly recommend it.

Also, I have found a local Go club, and found many awesome people there. It's a fun relaxing game, community is friendly, and it's natural to have conversations and form friendships there.

<comment><USER25> Do you have any tips for finding local pickup groups where the reputation is undeserved? that is, how can I find groups which avoid the misogyny I've seen in many online pickup groups and where they're focused on the skills to start and build mutually satisfying enthusiastically consensual interactions?

I ask partly because I've long wanted to learn to be a wingman, partly to nerd out about the study of social skills, and partly because my wife and I happen to have built ourselves a social circle with a couple of women who have talked to us about the frustrations of dating and it would be nice to help them find someone.

<comment><USER26> I don't think you are doing women any favors by introducing them to these people.

<comment><USER25> Hence my concern for avoiding the mysogyny and lack of respect for consent.

But there's nothing inherently wrong with being a guy who wants to better- understand how dating works and how to navigate it. Given that we still live in a world with patriarchy and where men are still more expected to play the active/seeking role ( _someone_ has to initiate), it is perfectly reasonable for men to ask "how do I dating?". I keep hoping that there will be a community of folks building each other up in this set of skills.

But the groups that I've seen are just...sigh...

I suppose one sign of a healthy group might be that it has a diversity of gender and sexual orientations (or is at least branding itself for that) and has discussions which follow from that. Another might be one which has lots of discussions about emotional/relationship skills in general. Like:

\- How to 'hold space' for someone in emotional distress.

\- How to listen to someone else in a way that helps them organize their thoughts/feelings

\- How to generate sexual tension on a date, either in new relationship or a longstanding one.

\- How to psych yourself up to have tough conversations or set boundaries despite discomfort.

\- How to check if you've violated someone else's boundaries in a way that leads to them feeling respected, while still being confident and not falling into scrupulousity.

\- How to tackle scrupulousity head-on or overcome feelings that you should make yourself small in social interactions.

\- How to notice when someone is feeling excluded from a group or doesn't know how to engage and then draw them into conversation in a way that makes them feel welcomed

etc.

Having members with longstanding relationships is probably particularly important as a sign that the advice that circles around in the group is actually effective and promotes healthy relationships. It also would allow it to be an actual community rather than something that people cycle in and out of.

</comment></comment></comment></comment><comment><USER27> I have the exact opposite problem: it's too difficult to politely exclude myself from potential social situations.

Seeing that some people consider "loneliness" as a problem to be fixed is a nightmare. I know I am very much part of the problem and I don't want to be fixed: I want to stay the fuck away from you.

<comment><USER28> Loneliness is a problem, it's just that too many people confused being alone with being lonely.

 _Our language has wisely sensed these two sides of man's being alone. It has created the word "loneliness" to express the pain of being alone. And it has created the word "solitude" to express the glory of being alone. (...) We are alone, perhaps in the midst of multitudes, but we are not lonely. Solitude protects us without isolating us. But life calls us back to its empty talk and the unavoidable demands of daily routine. It calls us back to its loneliness and the cover that it, in turn, spreads over our loneliness._

\-- Paul Tillich, "The Eternal Now"

</comment></comment><comment><USER29> Things must be very different in Australia. I can't even wrap my head around the concept of borrowing 2K from my neighbor or loaning him/her 2K.

I can't believe that's a criteria for loneliness.

<comment><USER21> I can't believe it either. Heck, even most (all?) family members and friends would probably balk at the idea of lending 2K for whatever reason.

Do most people's friends/families have the ability to just give out 2K in cash at the drop of a hat? Maybe yes if they're upper middle class or upper class and can just plonk thousands on a random whim, but I suspect someone making less than 40-50,000K a year would be hesitant, even more so if they're not super close.

<comment><USER30> I make less than 50k and I've lent ~20k to my brother within maybe 2 years.

Probably a combination of trust and me having no real big commitments that require using my money for myself. I think I put away ~1.5k USD per month in savings, maybe a bit less or a bit more.

</comment></comment></comment><comment><USER31> Over the years I've sometimes found groups arranging drop-in tennis or drop-in ping-pong. I made friends there, and it was a major part of my life. But none of those ever seem to last for more than a couple of years. Whoever controls the tennis courts eventually bans the group or intentionally schedules other things at their regular time. They always tend to view somebody scheduling things on "their courts" as an intrusion. The ping-pong meets a similar fate, especially since it is already hard to find places with more than one table, so as more people start to show up the drop-ins are told that they are no longer welcome. Private clubs are the same way - they monetize their resources, so they don't want "bursts" of activity that would inconvenience the regular flow of resource availability. I know this from experience (I've belonged to probably a dozen tennis clubs over the years.)

</comment><comment><USER32> Here's my unpopular opinion, and I'm making some assumptions for the sake of discussion.

For most of the history of civilization, people would stay in the same place, with their extended family and interact with the community through a church, temple, market, etc.

In the past 100 or so years, 2 things have happened. 1\. Career and capital have become prime directive for most people, supplanting family, community, church, etc 2\. Transportation is cheap and easy to move away from the few acres you lived in your whole life.

Note that I'm not saying that there is any greater virtue or value to any way of life, and the modern world is certainly more comfortable. But we evolved for millennia in these small (overwhelmingly rural) community units and perhaps our minds still crave that.

</comment><comment><USER33> Japan could do with reducing the salary man hour requirements. Give people the time to make friends!!

<comment><USER34> The family oriented people would go home and spend time with their families, but the non-family oriented people would go back to work -- that's where their friends are. Which would cause the family oriented people to go back to work because they don't want to miss out on the work opportunities. And you're back where you started.

Japanese culture is very different. All through their life Japanese people are part of a group and identify with that group. You are in a particular home room at school and they try not to mix change the home rooms all through junior high school and high school. You are a member of a _single_ club all the way through junior high school and then a _single_ club all the way through high school (and possibly a single club in University if you decide to join a club).

When Japanese people get a professional job, they _all start on the same day_ \-- The first Monday of April after they graduate from university. Professionals _never_ change companies. They work for the same company for the rest of their life. They work with the same people for the rest of their life.

The western media portrays the Japanese salary man as being lonely, but I don't think this is generally the case. If you don't fit into your group you are going to be lonely because you won't get another one. _That 's_ why there are some super lonely people. However, the majority of people are not lonely and have lots and lots of friends at work. It's just completely different than how it works in the west.

<comment><USER35> I wonder what is their salary if they stay in the same company forever. 1% increase early? This would make the job market really low paying.

<comment><USER34> It's really complicated. Basically salaries are quite low in comparison to many other countries. However, there is a "bonus" which is usually paid 3 or 4 times a year. Different companies have different schemes, but often the salary is based on position and the bonus is based on position and seniority. The overall compensation is lower than the US probably, but higher than many European companies. There are cost of living increases, but you don't generally get a raise without a change in position.

However, there are some other things that are important to realise. Generally the company looks after you for your entire life. When you retire, they will give you a lump sum retirement amount. I work for my own company in Japan and my accountant was very quick to point out the need for the company to save for my retirement. Additionally, you often get other "perks". For example, my wife's uncle lives in a house that used to be on land owned by the company he worked for. They sold him some land so he could build a house close to work. They even sold him some extra land so that he could have a garden (in a different location) -- and he made a tidy profit on that when we got too old to garden any more. This kind of thing (maybe not exactly, but similar) was expected before 1998. It's falling out of fashion these days, but for "permanent employees" (not on yearly contracts) it's still the norm.

The total compensation package is quite good in most companies, I think. Of course, there is a lot of competition to get into the best companies and once you are in, there is a sense that you've "made it". It's extremely difficult to get fired from a permanent position and companies will rather pay you a salary to do nothing rather than to fire you if things really don't work out. So, there is a lot of give and take. On the other hand, don't quit your job! Anybody who sees you were stupid enough to give up a permanent placement somewhere will not be interested in hiring you -- you'll be stuck on contract positions (and _much_ less security) for your whole life.

One of the things that westerners have difficulty with when comparing their situation with the situation in Japan (and probably some other SE Asian countries like Korea, though I have no direct experience with that) is that the companies treat their workers completely differently. In the west, there is no loyalty to workers. In Japan, anyway, the company is completely responsible for their workers' well being. It even enters into what would be considered private matters in the west like if you are overweight the company will feel compelled to do something about it because in the long term it's bad. Even for things like being single -- the company usually doesn't like it and will help you find someone to marry if you are having trouble in that department. It's just such a totally different experience that you can't compare it.

On a personal note, I worked on contract for a school division in Japan and even though I was on contract, the school looked after me. I needed surgery and for some bureaucratic reason the hospital needed someone to co-sign a loan guarantee in case something went wrong. The school took care of it. The principal was also worried that at the time I was over 40 and not married and assigned the school nurse to lecture me about the dangers of not getting my personal life in order (and even arranged for me to attend some gokon -- parties where you meet people who are interested in getting married... though I explained to them that my girlfriend wouldn't like it if I went :-) ). My case is pretty weird for a foreigner on contract, but for whatever reason the school decided to treat me like an employee.

Anyway, I'm kind of droning on and you may not be interested in all of this. I'm sure a lot of it is really weird to you and you may be thinking, "I wouldn't want that!", but I guess the point is that it's really hard to compare the situations. It's just so different here for full time employees. For someone like me, it works well because I tend to bury myself in work (which I enjoy) and I need someone to look out for me. That's probably why the school decided to take on that role. I'm bad at negotiating contracts and I like it when the opposite side takes a moral position to look out for my interests. It would be almost impossible to negotiate as good a position as you might get in the west, but it's also really difficult to get into as bad a position (as long as you are a permanent employee with a reputable company). As time goes by, this situation has gone from expected for almost every worker, to only being common for professionals. It's slowly moving towards the same situation as in the west and I, for one, feel a lot is being lost along the way.

It's funny because since I own my own consulting company now, I insist that I treat myself well. However, the expense of that is actually quite high and you would not believe how low my salary is :-)

<comment><USER36> FWIW I highly value your posts about life in Japan! I've been studying the language two years now and intend to move there, and the Japan posts in your comment history have given me a lens into life there that I cannot find elsewhere.

So thanks :)

</comment></comment></comment></comment></comment><comment><USER37> It's a lovely idea to design spaces for interaction, but I think there could be something said for quiet and privacy too. We probably need a balance.

I believe loneliness is an epidemic. I felt lonely recently for the first time. I'm mid 20s and in a relationship, lots of friends in my city, many in walking distance, but even so a few months ago I felt intensely lonely. I can't imagine what it must be like for someone who moved cities. What worked for me is writing down a list of people I want to see more and then reaching out and planning activities. I find if I have one date night and see one friend a week it's enough to keep me going and feel good. More is better of course.

</comment><comment><USER38> Nothing against lonely people, but personally I would prefer my city designed so I have as _little_ interaction with strangers as possible.

I meet enough people when I'm doing my hobbies/sports, and they are people with whom I share a common interest.

There's not enough personal space in the City as it is. I don't want to have a thousand meaningless interactions with strangers forced upon me when I'm trying to just get from home to work or whatever.

</comment><comment><USER39> Medium density seems to cultivate human connections the best (close enough to be near people, not so close as to need to protect your privacy). Basically walkable townhomes density.

[https://www.fastcompany.com/3021478/how-urban-design- influen...](https://www.fastcompany.com/3021478/how-urban-design-influences- how-many-friends-you-have)

</comment><comment><USER40> When I moved to London from Scotland I immediately felt more isolated than before.

I put it down to there being more people and more stress meaning a polite hello on bus or in a coffee shop is interpreted more as a hostile act.

After 3 years in London I decided to move back up north, sure my pay is not as great but I relish the moments when I can talk with a commuter or fellow patron in the local pub.

</comment><comment><USER41> More in-depth article on loneliness and impact on health, I can see loneliness having a direct impact in the future on people's health:

[https://www.webmd.com/balance/news/20180504/loneliness- rival...](https://www.webmd.com/balance/news/20180504/loneliness-rivals- obesity-smoking-as-health-risk)

</comment><comment><USER42> In the locality where I lived, families had been living for years in the same house as they own the houses. Everybody in the neighbourhood knew each other.

Now most of those families have sold off their homes and they were turned into apartments by the builders.

Now people don't even know the people who live in the floor above theirs.

</comment><comment><USER43> I saw this thread and made a youtube video about it: [https://youtu.be/GtqnQcDT9dQ](https://youtu.be/GtqnQcDT9dQ)

</comment><comment><USER44> An introvert's nightmare. I do hope this goes nowhere. I like my personal space, and peace. That's why I chose to live in a city in the first place.

<comment><USER38> _> I like my personal space, and peace. That's why I chose to live in a city in the first place._

wut

<comment><USER44> Yes, seriously. Less populated places tend to be less individualistic.

<comment><USER38> The pseudonymity that comes as a result of being part of a flock is not my idea of personal space and peace.

<comment><USER44> It is mine. Way more unlikely that somebody'll interrupt my thoughts to talk to me.

<comment><USER38> Possibly, but much more likely to be near somebody at all.

</comment></comment></comment></comment></comment></comment><comment><USER45> Make cities dysfunctional. Make things difficult, and hard to work out. Make the doors stuck , so that people have to ask strangers for help to open them . Write code with bad comments , so people have to ask each other what it means. Asking for small favors makes people more likeable to each other (Ben franklin effect). activities like cooking and tending and garden are great ways to engage with others fluidly, the problem is how you get people to do these activities in the first place without self-selection.

</comment><comment><USER46> This assumes that loneliness is from inablity to meet ppl. Ins't loneliness the inablity to connect ppl on genuine level. Meeting ppl problem is already solved by meetup.com

<comment><USER47> I think loneliness is the inability to meet people _with whom_ you can have a connection with. And the design of spaces can help or hinder that.

The deepest sources of connection come from shared adversity, shared goals/interest or shared stage of life. To meet people with these qualities, you have to first congregate them in time and space, and then give them opportunities for repeated exposure to each other [1]. (studies have shown that repeated exposure creates the necessary conditions for building rapport -- humans by default are evolutionarily guarded against unfamiliarity i.e. strangers, and repeated exposure lowers that guardedness)

That's why parents at a playground are able to, if they desire, connect with someone and to potentially grow that connection. They have shared adversity, shared goals/interests, shared stage of life and repeated exposure.

I have personally experienced how bad building designs hinder connection. At my workplace, the cubicles are high and large pillars block views, essentially creating a maze-like layout. One can walk directly to one's cubicle each morning without saying "good morning" to anyone on the way. My entire whole floor is oddly cold and introverted, and no one takes notice of what anyone else is doing. Most days folks don't even know if a co-worker is at his/her desk. In theory one can walk up to each person and say "hi", but it's weird and awkward, and people tend not to do it.

Whereas in my old workplace, the layout was much more conducive to nonchalant interactions, and we were much closer as colleagues and shared many funny and interesting conversations -- not everyone did of course -- but appreciably more did than at my current workplace. Having a bunch of co-workers that you're friendly with can immensely improve your mood throughout the day.

[1] I go to a lot of Meetup groups. Most are extraordinarily bad when it comes to repeated exposure, because in a big city, there isn't a common core group that consistently shows up -- it's different people every time, and it's hard to form community when your population is always in flux.

<comment><USER48> When I was younger being in the same neighborhood was the main way to make close friends. This wasn't just for kids, it seemed like my parents' close friends also tended to be neighbors. Now it seems like people's friends are more far-flung (as in 15 minute drive radius vs walking distance), and people who aren't able to maintain those kinds of connections as well also don't get the automatic friend opportunity of neighbors because their neighbors' social lives aren't as local. I think the internet and especially cell phones contributed to this by allowing some people to maintain friendships easier with people further away.

Don't know if that's generally true or just nostalgia + what I've seen.

</comment></comment></comment><comment><USER49> One way is:

Loneliness is solved by solving the inequality issue.

If others have fancy cars and silk suits.

How can a poor person fit in?

If we make everyone equal by taking wealth from Rich and giving it to the poors, we solve loneliness.

<comment><USER47> Some people who are in financial poverty have more community than more well- to-do people.

I live close to a refugee/immigrant neighborhood and despite their fears and worries, many are more connected to their families, friends and neighbors than I am. They seem to have more celebrations and get-togethers than I do with my friends. I regularly eat at restaurants there, and there's a warmth even for strangers like me that I don't experience in higher end places.

On the other hand, there's palpable loneliness among transplants to relatively affluent places like Minnesota, where despite surface politeness, is a society that is very insular and does not (and does not know how to) integrate outsiders.

Culture has something to do with it?

<comment><USER50> It's not culture, it's inequality.

For example, statistics from dating sites show how most people don't exclude potential partners based on ethnicity, nationality, religion, line of work etc but big differences in wealth is the line that people won't cross.

The same goes for socialization and architecture is affected by it: gated communities, single-family houses, gentrification, and so on. The word "exclusive", used in real estate, is telling.

All of this is meant to allow people that belong to the same social circles/companies/church to socialize and prevent mingling with people from other walks of life.

<comment><USER47> I believe I understand what you're saying. I'm curious though, how would that correlate with loneliness?

Loneliness arises from the gap between one's desired connections vs one's actual connections.

It is true that social class is a barrier and less mixing leads to less dynamism in society. This is a themed explored in Tyler Cowen's "The Complacent Class". But it seems to me that does not in itself produce loneliness, because there's still a tremendous number of connections made _within_ the same social classes. My working class friends are the least lonely people I know. They seem to have tons of buddies and tend not to be that selective when it comes to making friends. But except in specific instances, they have no explicit desire to make connections across classes.

I see inequality being a problem in general, but just not with respect to the specific topic of loneliness. It seems to me there's something else at play.

</comment></comment></comment></comment><comment><USER51> Pretty stupid article imo.

City planning has little to do with loneliness.

If a city council wants to combat loneliness they should provide its citizens with public spaces where they can organize non-profit meetups for free.

That's what we have where I live. Meetups.com is full of stuff from just social gatherings to nerdy stuff like programming and linguistics.

It's great for new arrivals who have no contacts yet.

With those facilities in place, the only thing feeding your loneliness is yourself.

Edit: Misspelled the domain but you can figure it out yourselves so I'm not guilty of plugging a service.

<comment><USER52> >City planning has little to do with loneliness.

>If a city council wants to combat loneliness they should provide its citizens with public spaces where they can organize non-profit meetups for free.

For those spaces to be provided, they need to be incorporated into the council's city/urban planning.

<comment><USER51> But that has nothing to do with design. This article is about design concepts.

A city merely has to earmark or promote the use of locations as public spaces. The design has little to do with it.

Yes it is city planning but it's not designing.

<comment><USER52> Form and function here are fundamentally interrelated. How you design your public spaces affects how effectively they can be used. A good public space should not only be well planned, but also appealingly designed, in order to attract users.

Consider a library.

If designed well, it can use its street frontage to give views in through windows to show activities taking place, and make it clear to passers-by that they are welcome to come in and use the space.

If designed poorly, it could have a sheer concrete street frontage with no views inside, that obscures what the space can be used for, or even what spaces may exist inside.

</comment></comment></comment></comment><comment><USER53> This probably doesn't scale up as nicely for density, but one aspect of my home town that I think was a strong anti-loneliness feature was the frequent presence of inviting front porch spaces and a culture of waving at people as you pass them by. It is nice to acknowledge each other in a positive way and you can strike up a convo if you're in the mood. There is a particular old man near my town who lives on a busyish road and literally sits on his porch all day and waves at each car that passes by. He himself said he started doing it because he was lonely, and members of community have said in interviews how they will go out of their way to drive past and greet him because that 1-1 genuine human interaction is sometimes the only one they get too.

<comment><USER54> That's great. It's only a shame that instead of driving by people don't walk or bicycle by, because that would allow for easier stopping and deeper interactions. Perhaps there are changes to the street design which would facilitate that, while preserving the car movement.

</comment></comment><comment><USER31> I think people have forgotten about all the things learned from cohousing. I once lived in a condo complex originally designed to be cohousing and I knew lots and lots of my neighbors. Shared parking with a common path and kitchens facing the path with gardening areas goes a long way. Add in the shared common areas which were designed to force everybody to pass by, and it was routine to meet and get to know neighbors. (Then there are all the Christoper Alexander ideas that could be tried too.)

<comment><USER19> I would hate that. Being forced to be social isn't my idea of fun. I want to choose who I socialize with not have it foisted upon me. You can pick your friends, but rarely your neighbors. I am as social as I want to be. If people are lonely, that's on them.

<comment><USER55> If you don't want to live in a society than you should be the one to leave.

<comment><USER31> I think you're being a bit harsh on the guy. I'd like to see a society that embraces as many people as possible. It should be possible to support both hyper-social and anti-social types - as long as they are willing to encourage a society that embraces those who are different.

<comment><USER56> I agree with your point.

If I may, however, make a suggestion, consider using 'asocial' instead of 'anti-social'.</comment></comment></comment></comment></comment>


Show HN: A 3D First-Person Shooter in WebGL in 24 hours - <AUTHOR> http://icecreamyou.github.com/Nemesis/

<comment><USER2> Awesome - reminds me of that maze screensaver that came with Windows 95/98.</comment>


Microsoft Put Off Fixing Zero Day for 2 Years - <AUTHOR> https://krebsonsecurity.com/2020/08/microsoft-put-off-fixing-zero-day-for-2-years/ <comment><USER2> So if I get this right, the attack vector here is

1) Take signed .MSI

2) Add my JAR of malware to the end of it

3) Send file to target

4) Target's computer recognizes the file as a signed MSI, ignoring the extra stuff at the end that's not part of the MSI

5) Target computer calls the JRE to launch the JAR

6) JRE ignores the MSI parts at the beginning of the file because compressed JAR files are loaded back-to-front

Obviously a major bug that signature validation ignores "extra" parts of the file, but a signature validation bug that (1) only affects specific types of files executed by a third-party runtime and (2) doesn't threaten system files (or any native executables at all) isn't an obviously critical vulnerability like an arbitrary "signature validation is totally broken" bug.

<comment><USER3> Disagree on lack of severity; this is the kind of thing that calls into question any signed MSI I've downloaded over non-TLS HTTP or even over HTTPS served from a possibly-downgrade-attacked HTTP→HTTPS redirect.

e: or any signed MSI from a compromised system, like happened to Palemoon last year: [https://news.ycombinator.com/item?id=20435699](https://news.ycombinator.com/item?id=20435699)

Endless rabbit-hole of course but that's already a lot of low-hanging fruit

<comment><USER4> If I read the description correctly, it would need to be a jar file, though, not an msi. The trick allows to hide a malicious jar file from the scanner, not to hide a malicious msi. I think it's better described by "take a malicious jar and prepend a signed msi to hide it from the scanner."

<comment><USER5> This is separate from anything an AV might do, so forget the scanner part. A virus scanner with a signature for this malicious JAR will still catch it. What this is avoiding is the prompt and extra scrutiny Windows throws up if you try and run an executable from the Internet.

Think of the legitimate MSI and malicious JAR files as separate short stories in the same book. The 'book' comes to your computer claiming to be one thing (the legitimately signed MSI) but the second chapter is something completely different (the malicious jar file). When your computer reads the book (calculates and verifies the signature) it only does it off the first chapter. That lets the second part slide under the additional scrutiny Windows applies to files downloaded from the Internet.

<comment><USER4> By "scanner" I meant the built-in windows defender tooling, which is - afair - affected. It trusts the signature. But you're entirely correct - a virus scanner that does not rely on the signature w could catch the malicious code.

However, this blog post mentions that various security solutions trust the windows code signing, but it does not mention which ones - [https://blog.virustotal.com/2019/01/distribution-of- maliciou...](https://blog.virustotal.com/2019/01/distribution-of-malicious- jar-appended.html?m=1)

<comment><USER6> >It trusts the signature. //

Wtf? Am I reading this right, if part of the file is signed by MS then it just doesn't bother running it through the detection algo?

That looks exceedingly like a designed in security hole.

Presumably paired with the OP "bug" means MS could, with an NSA letter say, drop malware on devices if those devices were using Windows Defender for AV.

Just as well MS don't snoop on what software user's are running./s

<comment><USER7> This isn't suspicious at all. All AV does it for good reasons, both efficacy and performance related.

And no, that's not how the NSA works.

<comment><USER6> All AV ignores files which are concatenated to an MS-signed file? Huh, presumably you mean only on Windows, but really? No AV treats .jar files concatenated with signed MSI as suspicious -- how did that situation arise?? It's a strange heuristic.

Isn't it like having a special 'I know my bag smells like drugs to sniffer dogs but I promise I don't have drugs' channel at airport arrivals; and when people go down that channel you don't bother to check their bags.

<comment><USER7> Yes, kind of like that. That's basically the point of digital signatures (when they don't have a bug to bypass them, like in this case).

They don't treat concatenated malicious files as safe, they trust that files signed by MS are safe. You aren't supposed to be able to concatenate a file and still have the signature check out. That's the bug.

If you want a good reason why, ask McAfee about the time that they incorrectly detected svchost.exe as a virus and made every customer's windows machine around the world unbootable.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> What about criminal liability? I know that it's highly unlikely that Microsoft will ever get what it truly deserves (at least as long as the USA remains what it is), but still.

I find it rather telling, how many argue that Microsoft is (obviously) wrong in their behavior, yet I don't read much about how the company deserves severe punishment (maybe even forced break-up or having control taken away from it altogether), for knowingly not fixing a security fuck-up like this, for this long. Maybe an interesting case for anthropologists one day, to study social/cultural conditioning.

I'm sure that Microsoft will have it's reasons and considerations, but that should not excuse or exclude them from liability for the consequences of their actions. Whether that will ever succeed in court, given both the reality of what Microsoft and the USA are (many other countries too, by extension), that is another story. But it should not take rocket science to figure out that it will only get worse if Microsoft gets away with this without repercussions (again). Guess, how we got here in the first place.

<comment><USER2> How would you define criminal liability to achieve this?

You have a bug that, _at best_ allows a third-party runtime to execute a malicious program without warning the user that the program is untrusted. Practically, how would you write a statute so that this case would be different from Windows not warning about malicious file in $arbitrary third- party file format$ that exploits bug in $arbitrary third-party software$? You don't want vendors legally responsible for the behavior of third-party code on their systems, that's how you get entirely walled-garden platforms that have no user freedom.

<comment><USER9> Laws don't need to be that specific, that's what the legal system is for. So instead terms like negligence are used which have very specific legal meanings, and then people consider if a Microsoft was legally negligent in their behavior. The downside is it's more vague, but the upside is it can rapidly evolve over time as new information comes to light.

[https://legal-dictionary.thefreedictionary.com/negligence](https://legal- dictionary.thefreedictionary.com/negligence)

<comment><USER2> Laws don't necessarily need to be specific, but if you rely solely on interpretation to distinguish between different types of responsibility involving third-party software, you will either achieve (1) appeals courts defining responsibility as narrowly as possible, or (2) the complete destruction of third-party software and all independent software development as no vendor is willing to risk exposure.

<comment><USER9> Liability is always limited to the value of the company. Thus even in the extreme case liability would at worst force companies to run each pice of software as it's own legal entity. Aka Microsoft is going to keep selling Windows as an OS even if they need to spin off a subsidiary.

<comment><USER2> Well, then you've still destroyed small independent software vendors, open source projects, and individual projects for which the cost and complications of running an LLC as a liability shield is unsustainable.

The issue with defining liability here is primarily what conduct should make a company liable in the first place (and doing so in a way without horrible consequences for user freedom), not what the damages can be.

</comment></comment></comment></comment></comment></comment><comment><USER3> Is the implication supposed to be "Microsoft finally given 'okay' to fix zero- day now that it is no longer useful to Intelligence?"

<comment><USER10> That was my first thought as well.

Why else would they leave a known vulnerability unfixed for _two years_!?

ISTM that someone else found out about the vulnerability out (" _... which Microsoft acknowledged was actively being exploited._ ") -- perhaps after the NSA used it against them? -- so now that the cat is out of the bag and _they_ are at risk of compromise -- they let Microsoft know and get it fixed.

<comment><USER11> This doesn't seem like the kind of vulnerability a security service would really care about. It's just about whether Windows does or doesn't show a nag prompt when trying to run the malicious file.

I doubt there are any real systems where the only thing standing between the system being secure or not is Windows code signing.

<comment><USER10> > _This doesn 't seem like the kind of vulnerability a security service would > really care about. It's just about whether Windows does or doesn't show a > nag prompt when trying to run the malicious file._

And yet, if memory serves, they went to the trouble of stealing a code-signing certificate from a software development company so that they could do _exactly that_ in an Iranian nuclear facility!

Besides, even if this one weren't all that useful on its own, we've seen time and again how a few of these these "minor" vulnerabilities can be "chained" together, eventually resulting in a full compromise.

<comment><USER2> To be specific, in that case the NSA wanted to install a malicious driver on Windows machines that required driver signature enforcement, so there was no other way to get a driver installed except to steal a certificate to sign their driver.

</comment></comment></comment></comment></comment><comment><USER12> > Microsoft's advisory makes no mention of security researchers having told > the company about the flaw, which Microsoft acknowledged was actively being > exploited.

Most likely part of an ongoing campaign by a three letter agency which would have requested the delay...

<comment><USER11> I doubt that three-letter agencies typically attack targets whose only protection is the Windows "this file may be dangerous, are you sure you want to open it?" pop-up..

<comment><USER3> Who said anything about "only" protection? Besides you, I mean. Real-world attacks tend to involve simultaneous exploitation of multiple vulnerabilities, like this real iOS Safari watering-hole/drive-by attack maliciously using the same exploit chains as my favorite iOS jailbreak tool: [https://googleprojectzero.blogspot.com/2019/08/a-very- deep-d...](https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive- into-ios-exploit.html)

<comment><USER13> I see. If you visit a sketchy website then it is entirely possible that you won't notice anything. If a random unsigned installer nag pops up after you clicked on an ad there is a decent chance that the user closes the dialogue and "walks" away unscathed.

</comment></comment></comment></comment><comment><USER14> The Virus Total detection list is very interesting [1]. How can your antivirus-software not detect a dangerous, publicly known, two year old exploit? How can anyone take these products seriously? Of course McAfee does not detect it.

[1] [https://www.virustotal.com/gui/file/dd71284ac6be9758a5046740...](https://www.virustotal.com/gui/file/dd71284ac6be9758a5046740168164ae76f743579e24929e0a840afd6f2d0d8e/detection)

</comment><comment><USER15> Kolmogorov's razor: never attribute to malice or stupidity that which can be adequately explained by uncontrolled complexity.

<comment><USER8> .. but keep your eyes peeled, for cases where the latter is intentionally used as a lame excuse for any of the two former (or Kolmogorov's razor itself, for that matter).

</comment></comment><comment><USER16> There is "zero day" mentioned in the title, but nothing in the article text. I am confused: what does this has to do with "zero day" now? It's not "zero day" now, is it.

<comment><USER17> It isn't zero day now but it was for at least two years. That rather stretches the definition of zero day but for two years Windows machines have been vulnerable to something nasty that was known about.

<comment><USER18> It was a bug in the third party scanning products though. ("This behaviour could be used to hide and distribute malicious code in MSI signed files, in fact several security solutions rely on the output of Microsoft Windows code signing validation to avoid an in-depth scan").

</comment></comment></comment><comment><USER19> What exactly is the attack vector?

Are the users supposed to receive an unexpected jar file and run it? Or can it pretend it's an MSI the user legitimately wanted, yet execute malicious code?

<comment><USER20> The latter. You download an MSI from some file hosting mirror, who cares, because you then diligently look and see that it has been signed correctly by the company that made the software.

But the vulnerability makes it rather trivial to have appended arbitrary content, even executable code, to it, without impacting the supposed validity of the signature.

This is really bad.

<comment><USER4> No, the former. The file is renamed it .jar by the attacker and executed by the java runtime. The msi part is ignored - it only serves to cloak the jar from the scanner - it recognizes the file as msi and ignores signed msi files.

</comment></comment></comment><comment><USER21> Wouldn't this be more so issue with Java and not Windows? As I don't think any good program should run a file it does not completely understand?

<comment><USER22> If microsoft was doing their job they wouldn't ignore a mysterious blob of binary stuck to their MSI. That is HORRIBLE, even the most 101 student of security would realize that, if you've ever even done a CRC on a file you would realize why that is HORRIBLE. I'm with the others in thinking that they deliberately ignored this for some reason, possibly 3 letter agency access.

</comment></comment><comment><USER23> Ive used this as a feature before to add some unique data into the end of an executable after it had been signed.

<comment><USER24> [https://xkcd.com/1172/](https://xkcd.com/1172/)

</comment></comment><comment><USER25> Well, you can just write an installer that uses an elevated cmd anyway. I think conemu does that? (not sure, maybe it is another software)

Is unsigned software subject to further restrictions by default compared to signed but "unknown" software (sometimes a pain to use with Defender)

And I kind of remember there was already other bugs with MS code signing checks? (not sure)

I agree this bug probably breaks the (informal/perceived?) security model of some hardened configuration, but that kind of hardening should not be considered completely sound anyway. It's like the UAC that is not to be considered a security boundary, yet somehow useful against casual threats or even just errors.

If you download and try to execute random code, you should consider it _will_ be executed regardless of the expected checks and perceived hardening of your system. And you should consider that your OS is full of security bugs absolutely everywhere. Your web browser too (yep, that means JS is an insane threat now).

Not really a reason to not fix that kind of things though, but nothing serious enough to loose our mind.

</comment><comment><USER26> Semantics question here: but if this was "actively exploited" for 2 years" \- when do we stop calling it a zero day?

</comment><comment><USER27> For anyone wondering, it looks like Windows 7 also recieved the fix.

</comment><comment><USER28> That's nothing. While nowhere near as severe there's an ansi padding bug in SQLserver when doing replication that they refuse to fix for going on 10+ years now iirc

</comment><comment><USER29> Well, its terrible they took so long to fix this, but it seems to me it was only a 0-day for one day two years ago?

Do people just use 0-day as a synonym for exploit now?

<comment><USER30> The zero in 0-day refers to the number of days since a patch/fix was released. Since a patch wasn't released for two years, it was a zero day that whole time.

<comment><USER29> Every definition I can find disagrees with your definition. People must use the term loosely.

</comment></comment></comment><comment><USER31> Calling that a zero day is a stretch since it requires a lot of user interaction and is local only.

It is not that scary of a bug.

<comment><USER32> nothing in the definition of "zero day" requires a bug to be "scary".

<comment><USER33> You are right, but to most people that term seems very scary. Most people don't know what zero day means, and so putting it in the title invokes doomsday type visions for a lot of people.

<comment><USER32> Most people that don't know what it means also aren't reading Krebs' blog. I feel like different expectations apply here than on a mainstream publication - where not using it in the title or immediately clarifying/reiterating the definition would be appropriate.

</comment></comment></comment></comment><comment><USER34> which means the millions of Windows7 installs still in use are vulnerable?

</comment><comment><USER35> This is why zero-days should be made public a week after reporting them to the company...without ANY fear of prosecution. Trust me, after the first 50 cases - the companies will have a dedicated team working on such exploits.

Wow, they made this public and MS still didn't handle it...I guess it should be more widely advertised then.

<comment><USER8> I fear that because of the asymmetric power/financial balance between the parties involved, such a choice could easily lead to a kind of war, in which the companies will have the upper hand. They will have may more means/resources at their disposal and when it gets ugly (out of the public eye) things could get nasty.

Please, don't get me wrong. On itself I think this whole responsible disclosure culture is bullshit. It wouldn't be if more companies actually treated it more sincerely. But I have seen too many companies abuse responsible disclosure, or simply hide behind bug hunting programs to limit/squash exposure (too many times even without fixing anything), and then burn anyone who doesn't want to play by rules they themselves set.

The problem is, there are far more things than just legal prosecution when this would turn into a clash between companies and security researchers. However, maybe a union or anonymous organization could level that playing field. Problem with that is that many security researchers also want recognition, at the same time as feeling safe (.. something about cake).

<comment><USER36> Just publish it anonymously? Make a site called exploithub and host it as a hidden service. I'm sure most cybersecurity professionals wouldn't have problems accessing it.

<comment><USER37> If you've already disclosed it to the vendor, a leak of the information shortly thereafter would likely not be so anonymous.

<comment><USER36> If you're disclosing it to the vendor, then you're probably cooperating with them and are going to give them 90 days to fix it. If they don't fix it within that time, anonymously publish it a month or two after. That gives a total time of around 4-6 months between you discovering it and the "anonymous researcher" on exploithub "independently" discovering it.

</comment></comment></comment></comment></comment><comment><USER38> I've always said Java was a virus.

</comment><comment><USER39> This is an easy and popular bug to write. The ZIP file format (which is used for JAR files as well), which puts the header at the end, is truly the sin that keeps on giving.

A consequence of this choice is that ANY file concatenated with a ZIP file is a ZIP file (and the same therefore goes for JAR files as well.) So if you concatenate an MSI file with a ZIP/JAR file, your MSI file detector will look at the file and go "yeah, looks good!", and your ZIP/JAR file detector will also say yes. (This also shows off the hazards of automatic filetype sniffing.)

This is related to one of the very oldest Android rooting vulnerabilities. The update.zip files use the signed JAR file format, where the file contains a signature on its own contents. Naturally the signature can't cover the entire file; it only covers the contents referenced by the header.

But the sin-that-keeps-on-giving strikes even harder here: The end-of-file ZIP header also has an end-of-header comment field, of arbitrary size! This means that a single file can actually have MULTIPLE valid ZIP headers. Which means two different tools can interpret the file as two different ZIP files (much as the bug here can interpret the same file as either a ZIP or an MSI.)

Don't do drugs, kids. And don't do automatic filetype detection. And don't do ZIP/JAR files if you can avoid it. And for the love of god, don't put your header at the end.</comment>


The Mundanity of Excellence  - <AUTHOR> http://books.google.com/books?id=55hTSMDJ2dEC&pg=PA29&lpg=PA29&dq=mundanity+of+excellence&source=web&ots=dq4hDNtvx3&sig=5zRc0nkEQAj10bfcIwM2cgzBMMg&hl=en#PPA29,M1 <comment><USER2> I remember having a conversation with a couple coworkers and my former boss about the nature of "talent". My hypothesis is that what we think of as innate talent or giftedness really arises from slight differences in pain/reward pathways in the brain, such that "gifted" people derive enjoyment from activities that the average person finds very boring. This leads to them practicing those activities more often, which leads to them becoming more skilled, which leads to _more_ enjoyment, and a positive feedback cycle ensues. The amazing feats we see are the cumulative results of years of this feedback cycle - at each stage, the gifted person is just a little bit better than the average folk and enjoys the activity just a little more, but over time that lead compounds.

That was my experience with math, and has for the most part been my experience with computers. Even when I was "on strike" in 6th grade and refused to do any schoolwork, I found it very difficult to avoid the math tests or homework. I tried once and found it so boring that on all further math work, if I wanted to protest how stupid the assignment was, I'd just do all the work and write down the wrong answers in the answer column or do it and refuse to turn it in.

When I quit my job to work on my startup, my former boss threw up all sorts of objections like "You have no idea if this'll work, and if it doesn't, you might find yourself writing lots of code for nothing, and that really sucks." And I just kinda looked at him a little funny. What I wanted to say was, "Dude, that's what I do anyway. That's what I do for you, that's what I do when I get home, and that's what I'd continue to do even if I cashed out for millions. There's nothing wrong with writing lots of code for nothing, and on the off chance it succeeds, it means I won't have to work for superficial idiots like you." (I didn't; I just said "Okay. I'm still leaving" and left.)

<comment><USER3> _what we think of as innate talent or giftedness really arises from slight differences in pain/reward pathways in the brain_

Wrong.

 _There's nothing wrong with writing lots of code for nothing_

Wrong.

<comment><USER4> I think you might want to add a little more analysis there.

<comment><USER3> I think that the person who makes a claim has to prove it. Especially when it is _prima facie_ nonsense. Presumably no one is disagreeing with my 2nd "wrong", but who knows.

<comment><USER5> I think "for nothing" meant "for fun" or "just because I feel like it," not "to procrastinate." And no, a person who makes a claim simply has to defeat any challenges to it--in science, this is known as 'falsifiability'.

<comment><USER3> A statement is falsifiable if it can potentially be shown false. His statements are certainly falsifiable, and I'm not criticising them on those grounds, but they are so annoying, almost unnatural, that I don't even want to bother with it.

<http://en.wikipedia.org/wiki/Falsifiability>

 _...is the logical possibility that an assertion can be shown false by an observation or a physical experiment._

It's probably stupid of me to respond to people by saying "wrong", but like everyone else I get weary, and so I have two conflicting feelings:

One feeling, to show why someone is wrong.

A second feeling, to merely assert that he is wrong.

The latter is quite a bit more efficient. I have this feeling almost every time I read one of nostro's comments, but usually suppress the urge. Oh, well. I mean, here's what he's positing: That abilities are based on different capacities for pleasure/pain, or somesuch. It's so silly, so unrealistic, that such a claim really does require actual evidence to even be taken seriously. The whole evolution of man would be nothing but redirecting pleasure and pain, rather than language, and intelligence, and motor skills, (etc, etc, etc) if that was the case. NONSENSE.

Of course, since no evidence exists for such a thing, no evidence was presented. And that is that. It's not easy to _prove a negative_ and so I just say, "Wrong". This rubs people badly. Oh, well.

<comment><USER6> You're wrong. At least I think so. Because you're not meeting your opponent at the same level of argument.

I'm simplifying somewhat, but...you appear to be saying that, for some definition of "cause", the evolution of man is "caused" by "language, and intelligence, and motor skills, (etc, etc, etc)". It is wrong, you say, to claim that the "cause" could be "nothing but redirecting pleasure and pain" (I'm not sure from where in the original you get that "redirection" aspect, but I'll copy it over).

But your argument is at a different level that that of the OP. Whereas the OP offers a theory, or maybe rather a hypothesis, of what could "cause" the evolution of language, intelligence, motor skills, &c., suggesting pleasure/pain differentiation as a primitive process, you just claim language, intelligence, &C. as somehow "primitive" processes in causing human evolution. You're not even trying to find out what "causes" them, whereas the OP is. You claim "non-falsifiability" for your opponent's claim, which I don't take for granted: it seems possible to check whether there are differences in the pleasure/pain differentiation of individual test subjects, and see whether that is correlated with those individuals reaching their goals. You just seem to want to avoid meeting the argument.

Which is wrong, I think.

<comment><USER3> _You claim "non-falsifiability" for your opponent's claim_

No, I said the opposite.

 _You just seem to want to avoid meeting the argument_

I didn't want to argue at all. I wanted to _assert_ just like the parent _asserted_. We both asserted and now it's over.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> If you all don't mind long articles, I hope I can be forgiven for a long comment. This is an excerpt buried in Zed Shaw's interview with Geoffrey Grossenbach transcribed here: <http://podcast.rubyonrails.org/programs/1/episodes/zed_shaw>

\---

Geoffrey: One thing I've always been fascinated whenever I've talked to you about it is just your personal process of development. You're definitely someone who tries to pick the best tools and customize them to make them work as well as you can. You also have something where you keep track of your bug rate and how many bugs you're writing, and tests that fail and then you adjust your process. How does that work?

Zed: That's not recommended for everyone. You have to basically be really, really disciplined. I'm actually not really, really disciplined; I'm doing it on one project, on my U2 project, and I'm tryout basically kind of like a quality control process – physical quality control. All I do is I track a bunch of metrics that don't necessarily say how many bugs there are exactly, but they're indicators of the bugs. I track them over time, and then I use statistics to tell me if I'm starting to suck or if I'm improving.

I'm doing mostly C coding on that project, so a lot of this is I'm running my program under Valgrind with heavy testing. Then I track what my test coverage is, and then basically it's just a series of numbers stream across my screen as I code. It's kind of like auto-test – when I compile the thing it codes it – and then about every maybe 300 sampled I take a break, go in and crunch the numbers, and I see if I did better than last month.

A lot of times what I'll do is I'll try a new technique; I'll try a technique for a while and then I'll go crunch the numbers and see if I actually had a statistical improvement or not. That's the biggest thing; I don't waste my time on stuff that doesn't actually improve the bug rate – the defect rate.

For example, at first I wasn't doing code coverage. I wanted to see if code coverage improved your testing – coverage of your test code, or your test code having coverage. I wanted to see if that improved quality. So I didn't do any code coverage. I measured all of my defect rates and figured out what my average defect rate was. I did maybe about 700 or 800 samples.

Then I started doing code coverage and beefing up my code coverage. I spent maybe about a month improving my code coverage. In C code it's real hard to get really good coverage because so many lines do so much stuff. But I got it up to about 60 percent. Then I went and crunched the numbers again to see if increasing the code coverage in test improved my defect rate.

What happened was it didn't improve my defect rate; my defect rate was still about the same. What it did improve was when I made changes – like if I had to do re-factoring – it reduced the amount of time to get my defects back down. So you make a change, you do your re-factoring, your defects go up, your defects go up, and then you have to spend time fixing all that.

With heavier, more test-coverage it made it go down quicker, but it didn't really improve my defect rate much. There's some complexity in that. When you have more coverage, you are seeing more of your defects, so that's part of it, but I found that test-coverage doesn't really justify an improvement in quality initially. It mostly just improves your time to fix later.

But out of the ways, that's some weird stats crunching. The process actually comes from the Capability Maturity Models – Skies, Watson Freeze, Personal Software Process. So all you've got to do is rather go get his book, go through what he recommends. The key is as your code. Keep metrics and then crunch numbers to see if that's improving things for you, and that's really all that is.

</comment><comment><USER8> Wow. This is a wonderful article that contains an analysis of excellence based on close observation of competitive swimmers over several years. One could even describe it as an excellent article, using its own definition of excellence. I doubt I would have run across it otherwise, so it's a really good example of why I read HN.

Tip: Google Books leaves out a few pages (in my case, 34 and 35). To read these, I went to Google Books in a different browser and searched for text from the top of the next page I did have (36). Their back button then took me to the missing pages. Note that using a different browser is essential (I suppose they use a cookie).

<comment><USER9> It was a wonderful article until it suddenly stopped in mid-argument.

Google Books is like being strapped to a library and tortured. And I do not have time to dork around with three different browsers.

Could somebody paraphrase this in a blog post and free it from the tyranny of restrictive copyright?

Note to publisher: I see that your 456-page book costs $45. Today I just want to read one article that spans 13 of those pages, without leaving my chair, waiting 2-4 days, losing my train of thought, or spending extra money on other pages that I don't have time to read anyway. If it were technically possible, I would happily pay you 13/456 of the book's price -- $1.28 -- for an electronic copy of the pages in question. I might even pay $2. But it's not technically possible, so I guess I'll just have to hate you today.

<comment><USER8> Two different browsers. And at most 30 seconds. But I take your point. Before that trick I tried googling for the article itself, and all I found was the publisher offering to sell it for $14. (It would probably take months to arrive, too.) There you have the market inefficiency. I'd happily pay, but nowhere near that much, and only if I get to read it immediately.

<comment><USER9> Mind you, I didn't mean to suggest that your handy advice was not very, very welcome. :) I might even get around to trying it later.

I just wanted to register my annoyance at the state of online publishing while it was still fresh.

</comment></comment></comment></comment><comment><USER10> So anyone want to take a stab at the qualitatively different practices that separate classes of people who program computers?

(Was about to write "people who hack", but think that hacking itself is a qualitatively different way of writing computer programs than what most people do.)

<comment><USER2> I mentioned some in a comment yesterday:

<http://news.ycombinator.com/item?id=185105>

<comment><USER11> For anyone who doesn't feel like clicking on nostra's link, CLICK ON IT and read his comment - it's excellent!

<comment><USER12> The link doesn't seem to work. :|

</comment></comment></comment></comment><comment><USER13> I couldn't get this from google books, but I was able to read it through JSTOR. I think my institution is providing this access, but perhaps someone else has it too...

<http://www.jstor.org/stable/202063>

<comment><USER14> I was able to get to it through the San Francisco Public library website using my library card. Best use of my library card in about 3 years!

</comment></comment><comment><USER15> here, I made this for you... Happy Mother's day... back to lurking. [http://www.scribd.com/doc/2926754/The-Mundanity-of- Excellenc...](http://www.scribd.com/doc/2926754/The-Mundanity-of-Excellence)

</comment><comment><USER16> Fundamentally important -- this belongs in the instruction manual to the human brian.

I do wish this author's prose style was less excellent at concealing this fact.

</comment><comment><USER17> 35 pages to get across the "deliberate practice" idea? I hate to be ever so demanding, but why are we voting this up when a much shorter article gets the entire point across?

(see <http://news.ycombinator.com/item?id=185533> )

Daniel

<comment><USER8> _a much shorter article gets the entire point across_

I so disagree. First of all, the article has more than one point; I'm surprised that's not obvious. For another thing, its supporting evidence and reasoning are considerable, relevant, and fascinating. More than that, I personally found it to be rich in subtleties, of the kind that would draw me back to reread and reflect. Does a vitamin C pill get across the entire point of an orange?

I know 35 pages of blah blah blah when I see it. This piece deserves closer attention. Look again.

<comment><USER18> My coach gave me a printed version of this article in 1997. I'm still thinking about it and give it the occasional re-read. This discussion thread really highlights how awful it is that so much research is locked up behind pay walls. I'm pretty sure the article was originally published in a sports psychology journal but here we are, a bunch of hackers, who are trying our best to enjoy it through Google book search (described above as like "being strapped to a library and tortured").

</comment></comment></comment><comment><USER19> bravo for sharing a thought provoking link and not a 5 second sound-bite.

</comment><comment><USER20> Cheers for posting this.</comment>


5 Tips to Becoming a Better Programmer - Tip #3 - <AUTHOR> http://javaprogr.am/refactoring-tools

<comment><USER2> > The IDE has automatically figured out what parameters need to be passed into > the new method that was created and passed in those variables for you.

I have never understood the "Wow" factor in having the IDE re-factor code. Sure the IDE will manage to do it, but the end result will be anything but ideal.

IMHO a human applying a level of intelligence and doing the refactoring by hand will always achieve a better result.

To highlight this point the final result produced by the IDE was this:

        @Test
        public void testDealingOfCards ()
        {
          Deck deck = new Deck();
          List<Player> players = deck.getPlayers();
          Dealer.deal(deck.getDeck(), players);

          for (int i=0; i<players.size(); i++)
          {
            List<Card> cardsInHand = players.get(i).getCardsInHand();
            assertThat(cardsInHand.size(), is(5));

            outputCardDetailsToConsole(players, i, cardsInHand, deck);
          }
          assertThat(deck.getDeck().size(), is(32));
        }

        private void outputCardDetailsToConsole(List<Player> players, int playerNumber,
          List<Card> cardsInHand, Deck deck)
        {
          System.out.println(players.get(playerNumber).getName() + " has the following cards:");
          for (Card aCard : cardsInHand)
          {
            System.out.println(aCard.toString());
          }
          System.out.println("The deck has " + deck.getDeck().size() + " cards in it.");
          System.out.println();
        }

If this code was to be truly refactored it should end up looking something like this:

        @Test
        public void testDealingOfCards ()
        {
          Deck deck = new Deck();
          List<Player> players = deck.getPlayers();
          Dealer.deal(deck.getDeck(), players);

          for (int i=0; i<players.size(); i++)
          {
            outputCardDetailsToConsole(players.get(i), deck);
          }
          assertThat(deck.getDeck().size(), is(32));
        }

        private void outputCardDetailsToConsole(Player player, Deck deck)
        {
          List<Card> cardsInHand = player.getCardsInHand();
          assertThat(cardsInHand.size(), is(5));

          System.out.println(player.getName() + " has the following cards:");
          for (Card aCard : cardsInHand)
          {
            System.out.println(aCard.toString());
          }
          System.out.println("The deck has " + deck.getDeck().size() + " cards in it.");
          System.out.println();
        }</comment>


Python and OpenGL for Scientific Visualization - <AUTHOR> https://www.labri.fr/perso/nrougier/python-opengl/#python-opengl-for-scientific-visualization <comment><USER2> I remember this domain/author name from his fantastic Matplotlib tutorial a few years back, which is still the best matplotlib tutorial I've seen in the wild, and made me realize matplotlib could be as viable as ggplot2 for good data viz: [https://github.com/rougier/matplotlib- tutorial](https://github.com/rougier/matplotlib-tutorial)

<comment><USER3> Jesus, I've just realized it's the author of the best numpy tutorial I've ever read! [https://www.labri.fr/perso/nrougier/from-python-to- numpy/](https://www.labri.fr/perso/nrougier/from-python-to-numpy/)

</comment></comment><comment><USER4> Thanks all. There is a new and ongoing book project at [https://github.com/rougier/scientific-visualization- book](https://github.com/rougier/scientific-visualization-book)

</comment><comment><USER5> This tutorial helped me to step away from the Fixed Function pipeline and finally grok the shader based programmable pipeline. (I am a hobbyist).

Glumpy, which is used in this tutorial -[https://glumpy.github.io/](https://glumpy.github.io/), is IMO the best way to work through [https://thebookofshaders.com/](https://thebookofshaders.com/) in python for a deeper understanding of fragment shaders.

</comment><comment><USER6> Wow, that is one beautiful online book.

<comment><USER4> Thanks.

</comment></comment><comment><USER7> What a great resource, I am learning opengl right now and also working on a scientific visualization project. Very much looking forward to rendering meshes.

Right now I'm trying to convert a ROOT based 3D event display to a blender plugin using python. Very curious to hear about the work and resources of others also doing sciviz work.

</comment><comment><USER8> One of the best introductions to graphics pipeline and primitives that I've seen. And I've seen a lot.

</comment><comment><USER9> Great book ! Does any one does know of a similar material but for opencl/Vulcan for gpgpu ?

</comment><comment><USER10> Is it down? I cannot access it.

<comment><USER11> He does say This:

"Last point, I wrote the book in a kind of modern Kerouac's style such that you can download it once and continue reading it offline. Initial loading may be slow though."

I do think the entire book is on a single HTML page

<comment><USER4> Yes, sorry for that. The post on hacker news put our server under some stress.

</comment></comment></comment><comment><USER12> Why is GLUT deprecated? This and just about every other tutorial I've seen uses it.

Since it's deprecated, is there something else I should be using?

<comment><USER13> The original GLUT has been abandoned two decades ago, it seems. Freeglut, a drop in replacement still seems to get regular updates and releases.

Alternatives that come to my mind are GLFW and SDL and you can also grab ImGUI for a nice, easy to use UI library that covers simpler use cases very well. They all deviate from how you use GLUT, but they aren't substantially harder to use.

</comment></comment><comment><USER14> @rougier, one thing I noticed reading it: the link to your research page in the Preface goes to a 404 (for me, at least).

</comment><comment><USER15> Very nice, when will the rest of the chapters be available? If anyone knows

</comment><comment><USER16> Absolutely astonishing work!

</comment><comment><USER17> Very cool reading...</comment>