Why Do Schools Fire Losing Coaches But Not Bad Teachers? - <AUTHOR> http://www.americanthinker.com/2010/12/why_do_schools_fire_losing_coa.html <comment><USER2> Coaches get to pick who is on their team. They have tryouts and some even get paid for it. But this only applies to high performing athletic schools (the ones you read about in the local paper that win county/state/regional titles). Other schools are purely volunteer efforts. The coach may be a teacher willing to give up free time everyday before and during the sports schedule.

For example, my history teacher was also the soccer coach. He wasn't great at it but someone had to wrangle a bunch of wiry teenagers and make them practice. He got nothing from it except the respect of his players.

The only teachers that get to chose their students are in governor's or magnet schools. Here students have to apply every year to be considered for the rigorous programs. Many teachers also apply for the job because of better pay, better students, and better curriculum. Teachers that don't perform can be fired. With a school full of motivated and talented students its entirely the responsibility of the teachers, they can't hide behind the excuse of lazy students and parents because, here, there are none.

The teacher in a poor school district doesn't have much of a choice. Some things don't work no matter how hard you try and the blame can't rest entirely on the teachers. But having poor students shouldn't be a fireable offense.

</comment><comment><USER3> People don't really care about whether students learn anything, the resultant catastrophes not being visible for years and then being hard to blame on anyone in particular. But they care about sports teams losing, which they see right away and makes them feel like losers right now, and it's easy to blame the coach.

</comment><comment><USER4> I clicked on the link to this article expecting some thoughtful questions on why poor teaching is a contributing factor to poor education overall in America, and how the system is doing much about it, but I feel like I read an entire article that can be summarized as "A lot of teachers are doing good work, sometimes under tough conditions, but plenty of them need firing too. We need a way to figure out the ones that need to be fired, somehow. Possibly involving test scores."

In my opinion, the question we need to be asking is not "how do we find bad apples" but "how do we improve the quality of the apple tree." Good education is hard to come by regardless of what teacher, or indeed, school district you come from. The problem may not be how good is teacher performance, or even how good is student performance, but what is the quality of the teaching goals and design of lessons. Once we've successfully answered that question, then we can focus on the teachers who consistently have "losing seasons."

</comment><comment><USER5> One word for you: "cut". Turn out for the basketball team short, slow, and unable to shoot, and you will not be suiting up. Hell, turn up as a "project" and you may be cut. A kid at my high school did not make the team until his junior year (as I recall). He got an athletic scholarship to college, was in the running for NBA rookie of the year, and eventually picked up a championship ring, not as a star but as a respected bit player. When he was 14 he could be cut from the team. I doubt his Algebra I teacher had any such option.

Another word: "recruit". Even the public high schools end up with a lot of athletes who do not live within the nominal boundaries. The high school a co- worker's son once attended is now a power in football. Why? The parents of a star athlete concluded they liked the program and found an apartment in town. A city high school is a power in girls' basketball, with players from all over the city. And then there are the Catholic high schools, the private schools, etc.

</comment><comment><USER6> I'll agree quite readily to the notion that there are bad teachers, but before we jump on the "Let's fire 'em!" train, there are some things to consider:

1) A teacher whose students consistently perform below grade level, but who jump 2 or 3 grade levels under her teaching (in the course of a year) is probably not a bad teacher. I know several teachers, particularly those who work with students for whom English is not a native language or who work with students with communiications barriers, where this is the case.

(My father is on the board of trustees of a school for the deaf and blind; this school consistently is one of the worst performing schools in the state, but at least part of that is because the vast majority of its students enter the school between 3 and 8 years behind grade level. I know the English teacher there, and she's responsible for some phenomenal gains, but even then it's rare that students will be reading and writing at grade level).

2) While we have a discussion of what bad teaching is, we also need to discuss what good teaching entails. "Sufficient progress on standardized tests" does not describe the teacher, but rather the students, and even then only on a single day. I'm willing to buy that there's some correlation between those tests and overall achievement, but would suggest that 3 hours is probably an insufficient amount of time to fully demonstrate one's learning over the previous 9 months.

Let's have a vibrant discussion of the how's and why's of teaching excellently, both in terms of what it looks like in action and what it accomplishes.

3) Finally, let's take a good look at what useful, worthwhile learning entails, and what it looks like. It may be that the system of bells and periods is more destructive than it is productive (I suspect this to be true, given my knowledge of my own workflow, as well as how I had to drastically alter my workflow when I taught), and it may be that we spend too much time on low-level skills (like rote memorization solely for the purpose of taking a test) and not enough time on internalization and contextualization of meaningful knowledge and skills (how many students have you known who could only solve a math problem when they knew ahead of time, by way of reading the chapter heading, what that problem would entail, but would not be able to solve that problem if they saw it mixed in with other types of problems?)

It's easy to say "Oh, let's fire the bottom 10% of teachers and replace them with excellent teachers", but such a statement falls flat on its face pretty quickly (for one, do we have a hidden reserve of these "excellent teachers", and if so, can we convince them to leave their more lucrative jobs elsewhere?).

It's much more difficult, but also much more worthwhile, to say "Let's figure out what excellent teaching and learning look like, in all their dimensions, and then let's see if we can figure out how to make it happen more often."

As far as education reform discussion topics go, I'd rather have the latter than the former.

<comment><USER7> _A teacher whose students consistently perform below grade level, but who jump 2 or 3 grade levels under her teaching (in the course of a year) is probably not a bad teacher._

Easy, reward the improvement in test results, not the test results. This could also encourage good teachers to go to lower performing schools (since they might see the largest gain (and hence pay rise) there).

 _for one, do we have a hidden reserve of these "excellent teachers", and if so, can we convince them to leave their more lucrative jobs elsewhere?_

Yes, pay them more. If you are very skilled at mathematics or engineering, you might be a good maths teacher. However you can get much better money working in Google, than working as a teacher. So pay maths teachers Google level salaries. You would have to pay teachers different amounts depending on what they teach.

<comment><USER8> Merit-based pay will never work as long as the unions and clueless administrators are in control.

In early 2002, I was working with a local high school's theatre group. Since I wasn't a parent, the rules said I had to get "hired" as a teachers' aide even though I was doing it for free.

I did the fingerprinting for the background check, provided a college transcript, and filled out the form. A month later I was rejected.

When I looked into it, I was told that I couldn't be a teachers' aide since I didn't take a college-level algebra class. In fact, I was asked "how did you get through college without taking any math?"

I pointed out that I had taken Calc 1-3, Diff Eq 1 & 2, Stats, Physics, and _oh yeah_ had a BS in Electrical Engineering. But since I didn't have a college-level class with "algebra" in the name, I was rejected.

I didn't expect the administrators to know how to _do_ Calc, but I did expect them to realize it was an advanced math class.

<comment><USER9> That's hilarious if true, I would assume that the majority of math teachers would have also skipped college algebra to go straight for Calc since this is pretty common today.

<comment><USER10> More appalling than hilarious. Putting even the algebra aside, by this logic the following would be forbid in this school:

-Thomas Edison assisting in a science lesson -Bill Gates helping kids learn to program -John Rockefeller teaching a business seminar -Michael Dell talking about supply chain -Walt Disney teaching an art lesson

All never obtained a college degree (save honorary ones). It would be one thing if primary education had a basis for its elitism. But instead they're failing at an increasing rate.

</comment></comment></comment></comment></comment><comment><USER11> Mlodinow in "The Drunkard's Walk" makes the very good point that the 'losing streaks' that lead to coach firings (and Hollywood studio boss sackings) are almost entirely explainable by perfectly normal random variation.

[http://www.amazon.com/Drunkards-Walk-Randomness-Rules- Lives/...](http://www.amazon.com/Drunkards-Walk-Randomness-Rules- Lives/dp/0375424040)

Not only that, but the subsequent 'improvements' are generally due to regression to the mean.

<http://en.wikipedia.org/wiki/Regression_toward_the_mean>

It's depressing that an pompously-titled site like American Thinker can completely fail to consider this...

</comment><comment><USER12> > what is the difference between coaching football or basketball and teaching > history or English?

1\. A sports coach can force a player out of the games or out of the team if that player doesn't attend the practices. Teachers have no such power: students can't be forced to practice the material out of school, and they can't be removed from class for not practicing.

1\. Standardized testing reflects, at best, decently the purpose and aims of general education. A competitive game of fotball, on the other hand, reflects perfectly the purpose and aims of football training. Simply said, the purpose of sports is to train a player to win the game. The purpose of general education is not to write a test successfully. Rather -- it _shouldn't_ be the purpose of general education.

The purpose of education is to disseminate knowledge and critical thinking skills. That purpose needs to be measured in a correct fashion.

Think how silly it would be, instead of a competitive game of football, that each team was given a set of drills to perform, on their own, on an empty field, to prove their worth in football. It'd be absurd. It doesn't fit the purpose of their training. The purpose of education shouldn't be to pass some tests.

A more constructive conversation, I believe, would be to find places, distinct disconnects if you will, where the method used to measure progress and achievement in education does not reflect the purpose and aims of education.

</comment><comment><USER13> Some football coaches do well because they have good players, not because they coach them to do their absolute best. Other coaches do well because they get lucky and win games by 1 or 2 points even though they don't coach very good football teams (Michigan State springs to mind). I wonder whether student test scores give a more or less accurate impression of performance than on-field performance. The existence of the tool is surely better than nothing, however.

</comment><comment><USER14> We need better ways to grade teachers than going by student performance in tests.

<comment><USER7> Why? What's wrong with student tests? What would you suggest?

<comment><USER14> You can check my answer below. But I am myself not convinced that is the best method.

</comment></comment></comment><comment><USER15> What about the effect of bad students? Isn't education a two-way process involving a supplier and a consumer?

I got my highest grades in subjects I enjoyed (Business and Mathematics) and my lowest grades in those I didn't (English). Was my English teacher not as good because I got a D yet the Business and Maths teachers got an A or B out of me? Does the fact that other students got A in English and a D or E in Business or Maths show that actually the English teacher is 'better'? Or was it just an anomaly?

Sure, there are no doubt a tiny minority of teachers who (in the UK at least) have paid thousands for a degree, gone through some form of postgraduate training and accreditation (years in total) only to land a job and then throw it all away. However, my own opinion is that 'bad teachers' are an excuse for bad students and (anecdotally and just in my experience) poor parental/primary caregiver role models. I saw the same 'my son/daughter is performing poorly because of bad teachers' come from parents whose children were more adept at petty crime and drug dealing.

</comment><comment><USER16> Visibility and Value. Athletics are far more visible, and thus on the community's mind to a greater degree; plus athletics has a higher value than education for most of our parents here.

In our community, the football team is number one. The team (and coach) receive far more media coverage for their wins and losses than classroom students get for test scores. Parents of football players value the victory more than academics as well. Parents will purchase hundreds of dollars in gear, shoes, summer camps, etc. but those same kids have no internet access, no notebooks, no highlighters, no basic computers or software.

Losing 10% of football games in a season gets the coach fired because everyone hears about it every day and because it is important to the school board and parents. 50% of our students drop out before graduation and it gets a paragraph on page 6 of the local paper, and no one cares because we have a great school: the football team won the conference again.

</comment><comment><USER17> There was a very interesting study done of the Shaker Heights school system in Cleveland that found parental involvement was the main determining factor of student success.

<http://www.racematters.org/whyareblackstudentslagging.htm>

Now, that's not to say that there aren't good and bad teachers out there and that we shouldn't find ways to reward the good and drive out the bad, but I think it's focusing too much of the attention on the wrong problem.

<comment><USER5> Shaker Heights is a very well off suburb of Cleveland. It used to rank in the top five cities in the country for per capita income.

<comment><USER17> That was sort of the point of the study. That even in a very affluent school district that different populations views of parental vs school involvement were primarily responsible for the large gap in student achievement.

</comment></comment></comment><comment><USER18> I like the way they handle this at the Sudbury Valley School (<http://sudval.org>). They essentially have realized that there is no objective way to measure a good teacher, so instead they take the darwinian approach. Every year all students (and staff) vote on which teachers thay want to keep, culling out the bad ones and just keeping the good ones.

They actually have had teachers so good that they have been re-elected every year for more than 40 years.

<comment><USER19> I'm glad they have good results with this system. I recall a teacher in my high school who was very unpopular with many students. He was an ex military man and what I am about to tell you will sound like a cliché: He believed in strict discipline, penalized students heavily for being slightly late or having corrections on submitted work, and so on. He actually invented a new form of punishment at the school involving hard physical labour. I don't recall anyone having a Hollywood epiphany when subjected to his brutal style, no wonderful breakthroughs or students discovering their hidden depths.

He would never have been re-elected by students. But was he a bad teacher? I don't know! I entered the school interested in the material he taught and left it still interested. Was he a bad teacher? Honestly, I have no idea. All I can say is that he was an unpopular teacher amongst many students.

</comment></comment><comment><USER20> A: No coaches union.

</comment><comment><USER21> I hear lots of smart people arguing that education can be improved by fired low performing teachers, breaking unions, enforcing discipline, raising test scores, etc. What I don't hear is lots of smart people saying, "Hey. I'm smart. I care about education. I think I'll become a teacher."

Not a single critic of education has come forward to say, I want to help by becoming a really great teacher.

<comment><USER22> You can't fix a broken system by becoming part of the system. _Many_ critics of public education have set up their own systems, of course--the whole charter school, Montessori, and homeschooling movements for example--but right now the best bet is to rescue children from the public school system and put them into something better.

Even if you can fix the public school system, becoming a teacher is not the way to do it.

</comment></comment><comment><USER23> The one difference that stands out to me is that sports coaches are allowed to pick their students for the teams and punish those who do not work. As opposed to most teachers which have limited control over who is in their classes and how to punish them if they are slacking ( besides bad grades ).

</comment><comment><USER24> Perhaps teachers unions and tenure are part of the reason that we don't fire teachers? Coaches don't have tenure.

</comment><comment><USER25> They fire losing coaches but not bad teachers because sports players want to win. Students do not.

</comment><comment><USER26> sports bring in money and affect the bottom line, bad teachers don't

<comment><USER27> <http://bit.ly/blfSNz>

According to Sports Illustrated, "Of the 120 athletic departments that play I-A football, 106 lost money in 2009"

</comment></comment><comment><USER28> a) Coaches can pick and choose their players. b) They get paid for the risk. Many schools pay more for a football coach than they do for the school principle.

Imagine if each class had to have academic try outs? Now imagine that teachers got massive wages and bonuses for winning academic competitions? Now reflect on the number of deadshits in your classes that never, ever, would have passed an academic try out for anything.

That's right, it's a stupid comparison.

The only good thing is that most people would know they have a second or third rate education. Because they never met the cut to get into schools who used such a stupid system.

<comment><USER29> Excuse my ignorance and lack of better knowledge with regard to American school system but what is the thing with high-paid coaches in _school_? What is the connection between a school and (semi?)professional sports?

<comment><USER30> A lot of schools charge admission to watch the sporting event, so even though the kids don't earn any money (and many times have to pay to play) the school makes a fair amount of money from the sports. The better the coach, the better the team. The better the team, the more people will come and watch. The more people that watch, the more money for the school.

<comment><USER31> The kids are not paid directly[1], but the kids that go to the schools that you see on TV _are_ paid indirectly in the form of scholarships and other perqs.

Depending on the school, a full ride scholarship has a value in the range of $10,000 to $50,000 and up.

[1] "Gifts" do happen, but there are severe penalties for both the kids and the schools when caught.

</comment></comment></comment></comment><comment><USER32> Why do wealthy corporations fire poorly performing employees but not bad corporate officers?

That question is probably more important and relevant than trying to find yet another rationalization for attacking the middle class. That articles like this appear on HN at all is an embarrassment.

<comment><USER33> At most Silicon Valley companys I've worked at, anything less than excellent performance resulted in executives losing their position - the equivalent of being "fired" (In some rare cases those executives stayed with the company in a reduced role, but that was rarely the case - who wants to go from Senior VP of marketing to manager of technical publications - and the requisite $500K+ year of compensation to $125K)

On the flip side, as long as the line employee was performing reasonably adequately - they were rarely fired. Only those who were performing abysmally were part of the typical 10% annual churn.

Your experience may be different, but, that was mine.</comment></comment>


Myths About Square - <AUTHOR> https://blog.squareup.com/townsquare/posts/top-10-myths-about-square <comment><USER2> This post seems half-hearted to me. It reads something like "Myth: Square is more expensive. Truth: No, we're not". If you want to be convincing, show me some numbers or at least give me some details. Even then, I am not sure I would ever post something like this. I was not aware that Square is fighting all these myths until now. I think I would have chosen "response" blog posts linking to specific, false, articles.

<comment><USER3> With respect to numbers, the pricing matrix Amazon mentions with their new CC processing system objectively beats Square's fees, which makes this statement in particular very odd.

[http://localregister.amazon.com/?ld=van_localregister](http://localregister.amazon.com/?ld=van_localregister)

<comment><USER4> Even though 1.75% is only till 2016, it's still pretty good for new small businesses who benefit from the 1.0% difference between that and Square Register.

<comment><USER3> The rate after 2016 is 2.5%, still lower than Square.

</comment></comment></comment></comment><comment><USER5> I can't believe how bad Square PR is especially with such a media darling at the top. How did it manage to lose so many large PR episodes such as Rabois, Starbucks, IPO, it's general health, as a workplace, etc (all the myths, I guess)?

It's on track for $30b+ in payment volume which blows away all other payments startups. It's one of the fastest growing payments companies ever. It's opened up a whole new merchant category.

And this blog post is so defensive.

Weird.

<comment><USER6> This is a truly bizarre post. I especially don't understand how they create myths that at least most people wouldn't think.

Like do people really think Square is not PCI compliant? Maybe they're just trying to do some SEO magic so someone searching for "is Square unreliable" will land there, but it's still odd. Why establish this negative relationship when it maybe/probably doesn't exist?

</comment></comment><comment><USER7> I'm not a PR person, but if you're going to do a "Top 10 Myths Dispelled" list, here's a recommendation:

These lists follow a standard format. You list the myth, and you list the counter-claim.

But why make the most prominent things on your page a bunch of untrue, negative things about your company?

Some people avoid this by not even listing the myth directly. For instance, for #1, they might just title it, "Square is NOT more expensive."

But if you do list the myth directly, I would put it in body type, but then make the counter-claim big and bold.

</comment><comment><USER8> These responses are obviously biased, and the language they use tends to make the responses even seem 'fixed'. An analogy is the Philip Morris CEO in 1994 famously saying he did not believe that cigarettes are addictive and killing people.

For example: "...the reports that we tried to sell the company, or of a delayed IPO? False. We're here for the long-term."

Is that really true though? Isn't it well established and known that Square postponed their IPO?

</comment><comment><USER9>
        If your Wi-Fi goes out or you're off the grid, just use Offline Mode.

Run WiFi jammer, use junk credit-card, profit?

<comment><USER10> Funny enough in most places parking meters are/used to be like that. I think most cities have retrofitted them with live authorization but there was a time you could use expired CC's for free parking to your heart's content.

I never did so myself but read about it as part of a massive upgrade program.

</comment></comment><comment><USER11> If Square has to publish a blog post to clarify what they do/who their customers are, it means their marketing needs to step up its game.

</comment><comment><USER12> I remember square going down one weekend and having to try and contact support. It was a nightmare. I tell everyone to avoid square if possible if taking transactions during critical times is a must.

I simply couldn't get through to them.

</comment><comment><USER13> I'm not so sure I completely agree with #9. The service itself is quite solid, and I do enjoy that part of it. However...

My reader was totally unreliable, taking many swipes to read a card, and then up and died on me. Never dropped it, never got it wet, nothing. All it took to kill it was letting it sit in its box on my for a couple months.

</comment><comment><USER14> Aside from the odd lists of "myth-busting". My issue with square is the one fee system you're based on. Major merchant systems have an extremely reduced amount for debit card purchases, which for many, if not most business account for the lion's share of their transactions.

In my research of Square versus the company I ultimately went with, a $1500 debit transaction was 10 times(no hyperbole) more expensive with Square.

Could you address that "Myth"?

</comment><comment><USER15> The major way Square is struggling is in keeping up the myth that Jack Dorsey is the new Steve Jobs.

</comment><comment><USER16> Can anyone explain why Square has recently been under scrutiny?

<comment><USER17> As far as I remember, it has started with article: [http://techcrunch.com/2014/05/02/with-ipo-hopes-fading- squar...](http://techcrunch.com/2014/05/02/with-ipo-hopes-fading-square-and- box-face-reality-of-commodity-products/)

Then many follow up, including famous: [http://avc.com/2014/05/the-valuation- trap/](http://avc.com/2014/05/the-valuation-trap/)</comment></comment>


Matheminecraft: Where math and Minecraft meet - <AUTHOR> https://phys.org/news/2020-04-matheminecraft-math-minecraft.html <comment><USER2> Unfortunate missed opportunity to build on top of Minetest (an amazing open source clone of minecraft that works really well) instead of re-implementing the hard parts yourself (unless that was part of the fun, which I totally understand!).

If anyone is thinking about doing something like that, you can develop entire games as "Minetest mods"[1] which would have allowed him to mostly just write "business logic." I've started writing a "game" using that myself.

Nonetheless, great idea and I'm glad to see it happen!

[1]: [https://dev.minetest.net/Modding_Overview](https://dev.minetest.net/Modding_Overview)

<comment><USER3> Wow, Minetest looks really cool: Minecraft clone with a Lua API for modding. This may get us back into using Minecraft modding as a way to learn programming.

EDIT: Oh, it's a game engine. Is there a basic 'vanilla' Minecraft clone based on Minetest, for this purpose?

<comment><USER4> > Is there a basic 'vanilla' Minecraft clone based on Minetest, for this > purpose?

Yes, it's the default `minetest_game` that comes with the game (as well as `minimal`). Note that the redstone-alike mesecons is a separate modpack (which isn't a problem in practice) as is mob support (which is).

</comment></comment></comment><comment><USER5> One side project that's on my bucket list is to implement very far range of view on Minecraft-like games (e.g. Minetest[1] and Terasology[2]). Something like what we see in Battle Royale games or open-world shooters like Farcry. It's a little frustrating to have such beautiful worlds in these games and not being able to see a large part of it in a stunning landscape.

I have no ideas what kind of techniques would be required. I'm not a computer graphics guy :)

[1] [https://www.minetest.net/](https://www.minetest.net/) [2] [https://terasology.org/](https://terasology.org/)

<comment><USER6> I am a computer graphics guy and I reckon it'd largely be a memory issue.

Essentially Minecraft is a voxel system which grows at a cubic rate.

This will quickly fill your GPU's memory and shortly there after system memory and shortly after that storage memory.

Rendering it on the other hand would be relatively trivial with a marching cube algorithm using one or more rays per pixel.

<comment><USER7> I thought you might render a snapshot of each few chunks from maybe 16 angles and compose them together like backdrop pieces on a stage. Update the snapshot every time a player moves over that chunk. Just patch into the render function: are we within the (basegame settings) chunk draw distance? (yes) - render the chunk - (no) - retrieve the "backdrop piece" for that chunk from this view angle, and draw it behind everything else rendered so far.

You could even add atmospheric effects to cheat and only save a monochrome image, then tint it progressively bluer and bluer (but not invisible) with distance.

<comment><USER6> But you've still got to load the chunks from some massive dataset stored somewhere and you can still look/run around in a full sphere at 60fps?

The backdrop pieces are effectively where the rays hit as far as I can tell from your description.

One memory optimisation I can think of is to store a bvh of the empty space and traverse that. Using a signed distance field might also help in the ray marching.

<comment><USER5> Maybe we could use something similar to PostGIS' spatial indexes to fetch only the cubes that we need.

</comment></comment></comment></comment></comment><comment><USER8> The proof of the characterisation of Eulerian graphs is really neat and one of my favourites. It basically just starts with "choose a maximal trail" and the rest writes itself if you think about it long enough.

</comment><comment><USER9> I suppose "mathcraft" was taken? :p

<comment><USER10> A quick search shows MathCraft Security Technologies [1] and MathCraft(TM): Math In Action [2] by Cycorp both exist.

On a similar note, I find it amusing that accidentally going to minecraft.com instead of minecraft.net brings you to the home page of a literal mining engineering consultancy [3].

"MineCraft Consulting provides innovative solutions and project management services for coal mining projects in Australia and Overseas."

"MineCraft is a registered trademark of MineCraft Consulting Pty Ltd."

[1] - [https://www.mathcraft.com/](https://www.mathcraft.com/) [2] - [http://mathcraft.ai/](http://mathcraft.ai/) [3] - [http://www.minecraft.com/](http://www.minecraft.com/)</comment></comment>


How to Protect Yourself from NSA Attacks on 1024-bit DH - <AUTHOR> https://www.eff.org/deeplinks/2015/10/how-to-protect-yourself-from-nsa-attacks-1024-bit-DH <comment><USER2> The OpenVPN section is misleading. The dh option is only supported on the server side. If you try to use it on the client side (which is what this guide appears to be tailored towards) it will be ignored and you'll use whatever DH parameters the server provides.

<comment><USER3> It may be misleading but also in the sense that there's no recommendation to just drop VPN altogether. How about we just stop relying on terribly over- designed protocols such as VPN and IPSec? Complexity is the enemy of security.

<comment><AUTHOR> We use OpenVPN at work to provide layer 2 access to a management network that uses a /24 out of the 10/8 range.

How else do you think we should do this?

<comment><USER3> MinimaLT [http://cr.yp.to/tcpip/minimalt-20130522.pdf](http://cr.yp.to/tcpip/minimalt-20130522.pdf)

</comment></comment></comment></comment><comment><USER4> The article says:

        You want to make sure that you don't see the text "_DHE_" in the list of ciphersuites.`

And the article links to [https://www.howsmyssl.com/](https://www.howsmyssl.com/), which shows me these in my list of cipher suites:

        TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
        TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
        TLS_DHE_RSA_WITH_AES_128_CBC_SHA

But the heading says: "Your SSL client is Probably Okay."

Is [https://www.howsmyssl.com/](https://www.howsmyssl.com/) out of date? Shouldn't I be seeing some kind of warning?

<comment><USER2> There's nothing inherently wrong with the DHE ciphersuites, as long as the server provides secure parameters. Since weakdh is really a server-side issue, and howsmyssl.com is a client-side test, a warning doesn't really make sense.

<comment><USER5> ... but clients can guard against weak server-side DHE by rejecting DHE ciphersuites. So I think the GP was correct that this diagnostic should be updated.

<comment><USER6> No, because as agwa pointed out, howsmyssl checks client security. There's nothing wrong with a DHE cipher suite and it can be used in a secure manner quite easily. Since this is wholly on the server, and howsmyssl has no way of testing a server you're connecting to, then there's no possible way for it to know if your specific connections are okay or not. Based solely on the client suites tested, DHE would still be considered secure. It's only the interaction with an insecure server that makes it insecure.

<comment><USER7> weakdh can be mitigated client side. The website[0] itself has a test for it, which works by requesting this file[1].

[0]: [https://weakdh.org/](https://weakdh.org/)

[1]: [https://dhe512.zmap.io/dhe512test.js](https://dhe512.zmap.io/dhe512test.js)

</comment></comment></comment></comment></comment><comment><USER8> Does anyone have links to bugs for the affected programs to make 2048 the minimum by default? It seems like we shouldn't have to continue to manually configure secure settings.

OpenVPN? SSH? Nginx? Apache?

Where are the bugs to make these not use insecure dhparams by default?

<comment><USER9> FWIU of the situation, we have reason to suspect the government has 'cracked' the default large primes that are commonly used by a bunch of different software packages, including web servers. Assuming they have, the challenge is then defined as determining which applications and sites tend to use these standardized or hard-coded primes.

> Breaking a second 1024-bit prime would allow passive eavesdropping on > connections to nearly 20% of the top million HTTPS websites.

I'll point out that agwa's comment is relevant here in mitigation. Without any control over what primes are used on the server side, the only resolution would be to detect the server is using such a prime and then avoid communicating with that server until they've patched their systems. Perhaps someone who knows more about this could comment on how we could go about notifying websites they are using venerable primes?

Maybe a Chrome plugin attached to an IPFS client could be one method to warn on access of sites using default primes.

<comment><USER10> The problem (defined as narrowly as possible) should be as simple as finding every application that uses 1024 bit Diffie Hellman and making it use 2048 bit Diffie Hellman instead.

</comment></comment></comment><comment><USER11> Is this really a "best practice" to disable dhe in firefox/chrome?

Won't that just make the server/browser negotiate an even weaker scheme if they cannot find a matching higher set?

My firefox goes from:

        TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
        TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
        TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
        TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
        TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
        TLS_DHE_RSA_WITH_AES_128_CBC_SHA
        TLS_DHE_RSA_WITH_AES_256_CBC_SHA
        TLS_RSA_WITH_AES_128_CBC_SHA
        TLS_RSA_WITH_AES_256_CBC_SHA
        TLS_RSA_WITH_3DES_EDE_CBC_SHA

to:

        TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
        TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
        TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
        TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
        TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
        TLS_RSA_WITH_AES_128_CBC_SHA
        TLS_RSA_WITH_AES_256_CBC_SHA
        TLS_RSA_WITH_3DES_EDE_CBC_SHA

Do you really want TLS_RSA? How about 3DES?

<comment><USER12> RSA key exchange is still secure, but you lose PFS when downgrading to it since very few servers will generate ephemeral RSA keys like they will when using DHE. 3DES is secure, but slow.

Ideally, you would want to just disable all ciphersuites that don't use ECDHE to do the key exchange, but that would probably hurt compatibility.

</comment></comment><comment><USER13> Anyone have a way to fix up Safari on OS X 10.11?

<comment><USER14> You can't fix this on the client side, but on the server side.

<comment><USER15> Please read the article before posting. There _are_ some things that can be done client side to raise the minimum level of encryption, although not to raise the maximum level of encryption.

One tactic the NSA and at least one vendor are suspected to use is to inject/drop a header which prevents the client and server of an SSL/TLS connection from settling on the highest level of encryption that both the client and server have. In this case, it's best for your client to disable the weakest forms of SSL/TLS encryption which raises the minimum level of encryption of the connection.

That's what much of this EFF article describes, although it fails to describe these steps for browsers other than Firefox and Chrome.

</comment></comment></comment><comment><USER16> Sadly, users who follow this advice will forget that they did by the time they can't figure out why connections fail to servers that have been configured for forward secrecy only but run an ECC-incapable version of Apache (thanks to long-term support Linux distros keeping old Apache around).

<comment><USER17> Apache decides the DHE keys, OpenSSL decides the ciphersuites used. Red Hat didn't even enable ECDHE until they moved to OpenSSL 1.0.1 in RHEL 6.5 in late 2013.

<comment><USER16> Last I checked (updates may have fixed this), Ubuntu 12.04 had ECC-capable OpenSSL but ECC-incapable Apache.

<comment><USER18> tlsinterposer[0] helps in cases like this. (tldr: LD_PRELOAD middleware to upgrade an application's OpenSSL support without modifying the application.)

[0] [https://github.com/Netfuture/tlsinterposer](https://github.com/Netfuture/tlsinterposer)

</comment></comment></comment></comment><comment><USER19> Tor browser 5.0.3/latest(based on firefox 38.0.3) is not listed. However, it does have .dhe enabled/"true" set in the config file. For those of you running - it might be good to add this to your disable "to-do" list.

<comment><USER20> It's worth noting that modifying Tor Browser like this makes your TB easier to fingerprint/track.

I'm not saying people shouldn't do it. But just be aware of the trade-off.

</comment></comment><comment><USER21> If you're having trouble following the instructions to secure SSH on OSX, try following the directions here: [https://mochtu.de/2015/01/07/updating-openssh- on-mac-os-x-10...](https://mochtu.de/2015/01/07/updating-openssh-on-mac- os-x-10-10-yosemite/)

Without using the brew dupe and ` --with-keychain-support` flag, I was getting cipher errors when trying to use SSH after following the instructions linked to in TFA.

NB: I am not a security expert.

<comment><USER22> You may have a cipher mismatch with the server. If you use ssh with the -vv flag you can see which ciphers the server is supporting and compare that to the ciphers your client supports.

<comment><USER21> Thanks for the tip--the server supports that cipher though, it was just an issue with my client.

</comment></comment></comment><comment><USER23> Is TLS w/3DES still considered safe (TLS_RSA_WITH_3DES_EDE_CBC_SHA)? My guess is that it's the next to "go", but is it a risk currently?

<comment><USER2> 3DES (the cipher) is secure but incredibly slow. It's often included in server ciphersuites to support old clients (the alternative for old clients is RC4, which is not secure).

Edit: I should mention though that 3DES as used in TLS is vulnerable to BEAST if not mitigated client-side and possibly Lucky 13 too, so the ciphersuite ought to be the next to "go" along with the other CBC ciphersuites. Still better than RC4 though.

<comment><USER23> Thank you I had an idea of the performance delta. But, comparatively (to something like TLS_RSA_WITH_AES_[256|128]_CBC_SHA) how does it compare?

Edit: Thanks for the edit! What I was looking for.

<comment><USER24> Very poorly: [http://zombe.es/post/4078724716/openssl-cipher- selection](http://zombe.es/post/4078724716/openssl-cipher-selection)

<comment><USER23> Thank you for the reference!

</comment></comment></comment></comment></comment><comment><USER25> If you use "Chromium" on linux instead of "Chrome" you can do this; (create a shortcut with this command)

chromium --cipher-suite-blacklist=0x0033,0x0039,0x009E,0xcc15

Also if you use Nginx web browser; (read this article)

[https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx....](https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html)

<comment><USER26> Nginx is a server, not a browser.

</comment></comment><comment><USER27> Wont this just prompt NSA to crack the others if they see a spike in disabled crackables?

<comment><USER28> Valid concern, but that's a bit a defeatist attitude. Yes if we all switch to more secure encryption, they will try to crack or cripple those, but to crack 1024 DH was a multi billion dollar effort (just on the cusp of what it feasible for them). If we can use something more secure, then it's out of their ability. The good part is that often we can increase the difficulty to crack something by an order of magnitude without a high cost to us.

</comment></comment><comment><USER29> Is there any reason why in TLS the DH g^x the client sends is not encrypted with the server's RSA key?

That way, a DH compromise merely lose forward secrecy and the data would still be safe as long as the server private keys are not compromised.

<comment><USER30> Strictly speaking that's not forward-secret anymore, as stealing the private key gives _some_ advantage to cracking the session.

The practical reason is probably that using DHE with TLS is already many times slower than (plain) RSA. This would only make it slower.

</comment></comment><comment><USER31> My big picture take-away is:

It seems that the NSA (and possibly other state-level actors) can access encrypted traffic that uses 1024-bit Diffie-Hellman that use commonly-used prime numbers. This means HTTPS, SSH, IPsec, SMTPS, and protocols that rely on TLS are potentially vulnerable. Where's there's smoke, there's fire and there's a lot of smoke indicating the NSA can do this. They have the money, technology, infrastructure and the technical ability to pull this off.

From [https://weakdh.org](https://weakdh.org): >Breaking the single, most common 1024-bit prime used by web servers would allow passive eavesdropping on connections to 18% of the Top 1 Million HTTPS domains. A second prime would allow passive decryption of connections to 66% of VPN servers and 26% of SSH servers. A close reading of published NSA leaks shows that the agency's attacks on VPNs are consistent with having achieved such a break.

 _This is real_.

It's all of the networking infrastructure that no longer gets software/firmware updates running 512, 768 and 1024-bit Diffie-Hellman that are likely already being exploited, not to mention all of the old VPNs, email servers, SSH clients, etc. that can't be easily upgraded and can't use more secure encryption protocols. After all of the hoopla dies down, this is the ongoing problem.

 _But don't panic._

On current operating systems, going to larger 2048-bit Diffie-Hellman or using Elliptic-Curve Diffie-Hellman Key Exchange (ECDH) addressed the problem. As has been pointed out several times, 2048-bit Diffie-Hellman isn't double the strenght of 1024-bit Diffie-Hellman; we're going from a keyspace of 2^1024 to 2^2048. So unless there's an unprecedented crytography breakthrough or quantum computers start sprouting like Dandelions, 2048-bit Diffie-Hellman is firmly in the "it would take more energy than what would be required to boil all of the oceans on Earth" arena.

If you're going the ECDHE route, everyone agrees that the NIST curves are suspect and that Curve25519: [http://cr.yp.to/ecdh.html](http://cr.yp.to/ecdh.html) is what you want. More at SafeCurves: [http://safecurves.cr.yp.to](http://safecurves.cr.yp.to).

If you keep up with current cryptography trends, you're probably already in a good place, but it doesn't hurt to check. There are lots of guides on how to get your stuff right:

* Secure Secure Shell: [https://stribika.github.io/2015/01/04/secure-secure-shell.ht...](https://stribika.github.io/2015/01/04/secure-secure-shell.html)

* Mozilla's Security/Guidelines/OpenSSH: [https://wiki.mozilla.org/Security/Guidelines/OpenSSH](https://wiki.mozilla.org/Security/Guidelines/OpenSSH)

* Guide to Deploying Diffie-Hellman for TLS: [https://weakdh.org/sysadmin.html](https://weakdh.org/sysadmin.html)

* Qualys SSL Server Test: [https://www.ssllabs.com/ssltest/index.html](https://www.ssllabs.com/ssltest/index.html)

<comment><USER32> _" It seems that the NSA (and possibly other state-level actors) can access encrypted traffic that uses 1024-bit Diffie-Hellman that use commonly-used prime numbers."_

How does it "seem this"? There's no evidence, no plausibility, no sense here whatsoever. Someone hypothetically conjectured a magic all-powerful computer that could magically crack a prime, and that would magically make us all vulnerable to the government who want to steal the data from my recipe startup and the church newsletters documents on my laptop.

And therefore, system admins are all recommending upgrading to 2048 keys?

I can't see the sense or logic here. It just seems hysterical conspiracy nonsense to me.

<comment><USER33> It seems like you're calling section 4.1 of the paper "magical"; do you have something specific in it to object to that makes you think the estimates are severely mistaken?

In order to defend against adversaries with undisclosed capabilities, you have to extrapolate known attack methods and hardware to produce estimates of what may be practical. _Every_ paper that proposes keylength and parameter size recommendations does this. If we didn't extrapolate this way, there would have been no reason to stop using 56-bit symmetric ciphers until 1998 (!). The hardware necessary to crack such a cipher could have been dismissed as "magical" because nobody who had built it had published a paper about it.

<comment><USER32> It is magical. There is a magic 36000-core (?) computer that has been running for years (?). Well no, the paper just invents it. On the hearsay that an "anonymous nsa official" said they'd cracked something.

It astonishes me that people are running about like rabbits in a headlight on such flimsy nonsense.

But I understand. It makes us feel important. The new James Bond movie is coming out. And imagine! We're like a superhero secret agent. We can protect from the big bad government by increasing all the keys to 2048 bits! And we get to feel special and important.

Sigh.

<comment><USER31> _Classified documents published by Der Spiegel [46] indicate that NSA is passively decrypting IPsec connections at significant scale. The documents do not describe the crypt- analytic techniques used, but they do provide an overview of the attack system architecture._

Due to the Snowden leaks, we know the NSA is doing something that they haven't been able to do previously. The paper just explains, given what we know today, how this is plausible. There's nothing magical about that.

</comment></comment></comment></comment></comment><comment><USER34> How can you tell if the commercial VPN service you are using is vulnerable?

The client on mine is very easy to use, but has no debug output/log or console that I can find so I don't know what it is doing.

<comment><USER33> Do you know what VPN protocol it is? I wonder if it would be easy to figure out in Wireshark if you had a recording of the beginning of a session.

<comment><USER34> QUIC is what WireShark says I am looking at. I can see the DNS lookup, and then a stream of encrypted UDP packets with not much plain text in the payloads.

I get what the other poster says about asking the provider, but I wouldn't have much confidence in the answer.

<comment><USER33> I'm not really familiar with QUIC, but are there any cryptographic setup steps that Wireshark can parse out of the first (say) three or four packets that get exchanged? (Or maybe the key was established when you first used the VPN and is being cached on your machine and re-used whenever you reconnect?)

</comment></comment></comment></comment><comment><USER35> Not working for Chrome on Linux. Starting Chrome with blacklist arg still shows _DHE_ entries.

Chrome: 46.0.2490.71 Linux: 3.19.0-30-generic

<comment><USER36> The same for me on Windows 7 Pro 64-bit, Chrome 46.0.2490.71 m

</comment></comment><comment><USER37> The fact that the NSA doesn't include DHE in its Suite B Cryptography algorithms is quite telling ...

</comment><comment><USER38> what about just no using encryption and dont doing stupid stuff like delivering drugs to your house using your own name?

</comment><comment><USER39> I get that NSA snooping is abusive if it's the norm. But who exactly would really want to protect themselves from the NSA?

I mean ultimately, isn't the problem the NSA is snooping on people who aren't aware of it ? Why would someone try to hide itself from the NSA ? Is it just because it's a political principle or to just annoy the NSA and discourage them ? I mean wouldn't this help the bad guys more ?

<comment><USER40> One of the main things I want to keep private is just family life - conflicts, love, sex, etc. I don't want the government to know about my private family life. I don't see how a free, thoughtful, creative society can flourish if the government can always know the goods on everybody.

<comment><USER32> I don't think the government wants to know about your private family life neither. I mean, it's edgy to imagine that the government has a secret file on all of us. But they don't do they? It's just very silly nonsense.

<comment><USER41> That was the argument before Snowden, but we now know that the government passively records and stores as much information as possible on anyone. So they _can_ build a secret file on anyone should they feel like it. And they'll use every piece of information at their disposal (private family life, shopping and travel habits, what websites you browse, what media you consume, etc.) to profile you. Ever download a copyrighted file or view pornography? That will be used against you.

<comment><USER42> > we now know that the government passively records and stores as much > information as possible on anyone

That's highly impratical. NSA's budget isn't infinite and they have many other operations that would also require funding.

<comment><USER43> Snowden demonstrates the way NSA and the British equivalent operate on demand* at the documentary film 'Snowden'. You should really skim through it at least, you will be surprised to what their finite budget can do.

* they collect bulk data, then develop the tools to sort them out

</comment></comment></comment></comment></comment></comment><comment><USER44> It's strange that this is all coming up just now. The NSA has had this technology since at least 1992 when it was revealed in the gripping documentary movie "Sneakers".

<comment><USER45> Then again in Enemy of the State, which should have won the Pulitzer Prize. Hollywood has been warning us about this stuff for years!

</comment></comment><comment><USER46> This recent publication illustrates a problem that we have trying to keep our communications secure. If we all use a single "strong" prime number with our crypto then the NSA has a huge incentive to pre-compute results from that single strong number. Now that we know that the NSA is doing this, we won't all use a proven strong number, and we will all start to do key exchanges with another method, and it will become the common thread that the NSA can attack.

So the NSA will pretty much always attack whatever common procedure we all use and find the weak point. If we all used different methods for key exchanges and encryption then we will all be fractured and the NSA can easily pick off their targets individually. What's the answer to this problem? Is there crypto that we can all use that the NSA won't be able to crack even if they have a strong incentive to do so? And why aren't we all using if such a solution exists?

<comment><USER10> Not really. This precomputation attack only works because attacks on 1024 bit discrete logs were already plausible.

We don't choose cryptographic parameters to make the NSA's job _harder_ ; we choose them to make the job _implausible_.

So it's exactly the wrong message to take from this paper that we should mix up parameters more; rather, the message is: don't use weak moduli.

<comment><USER46> > don't use weak moduli.

By this do you mean don't use 1024 bit keys? Would using 2048 bit (or larger) mean that the NSA wouldn't be able to buy a computer that could do the computation within a year?

Why don't we all use 2048 bit keys then? Is the communication and processing overhead so high that we'd rather be vulnerable?

Edit to add: I'm not an expert, but I'm competent enough to force a certain level of crypto on my computer and to know not to trust the communication when a website forces a fallback to a lower level. But sometimes I wish there was a level of explanation (of why we want to do certain things) that was above what you would give to "Joe off the street" and below the explanation that you would give to a graduate student in cryptography.

<comment><USER12> > By this do you mean don't use 1024 bit keys? Would using 2048 bit (or > larger) mean that the NSA wouldn't be able to buy a computer that could do > the computation within a year?

Keep in mind, going from 1024 to 2048 bit DH parameters doesn't double the search space, it raises it from 2^1024 to 2^2048. At some point the search space gets so large that you'd need more energy than required to boil all of Earth's oceans to find the key, which makes such a brute-force attack implausible.

<comment><USER47> I haven't had much crypto-in-practice background (outside of thought experiments), but I have some math background so I'm quite curious. Shouldn't people also be worried about non brute force attacks based on finding mathematical solutions? I mean, "The Uneasy Relationship Between Mathematics and Cryptography"[0]?

[0] [http://www.ams.org/notices/200708/tx070800972p.pdf](http://www.ams.org/notices/200708/tx070800972p.pdf)

<comment><USER10> The attacks we're talking about _are_ non-brute-force mathematical attacks (specifically, in this case, the index calculus). A pure brute-force attack on a 2^1024 search space would be comically implausible.</comment></comment></comment></comment></comment></comment>


Homelessness in the Bay Area (2017) - <AUTHOR> http://www.spur.org/publications/urbanist-article/2017-10-23/homelessness-bay-area <comment><USER2> Why depend on government to address this problem? If several thousand Bay Area families would step up and volunteer to provide shelter and long-term social and financial support to the homeless population, the problem could be solved in short order.</comment>


Ask HN: What is your information distillation pipeline? - <AUTHOR> I have been struggling with this for years now. I read articles on Medium, watch YouTube videos, daily check Twitter, HN, Reddit, etc. When I find a paper I like I queue it to to my Mendeley list. When I like an article I add it to Pocket. When I like a tweet I bookmark it. When I have time I try to consume some of the stuff I save. Yet it feels like I'm not making any good use of the information I'm putting into my brain. Many of the things I added I lost interest in because too much time passed, and others I just skim through even though I should be reading it in more detail and taking notes. When I take notes I struggle to organize them and make them easily searchable for posteriority.
This leads me to ask you how you go about dealing with the tons of information that internet makes available to us. I want to call this the "information distillation pipeline".
What sources do you use to learn new things and keep track of the novelties in your field?
How do you decide what is worth reading deeper into, spending more time on, etc?
How do you organize yourself to queue the information you want to dive more into when you have time?
How do you take out the bits of information that actually matter to you? Do you record them somewhere? A diary? A mind map?
How do you browse the information you have recorded? Do you try to memorize it? Add tags? Just basic word search? Complex folder structures?
A related post is https://news.ycombinator.com/item?id=20847508, but it only talks about books. Certainly they are one important source of information and the post gives many good insights, but I would like to revive the conversation with a broader spectrum of sources and focusing more on the whole pipeline and searchability of your saved knowledge. <comment><USER2> 0\. Before starting, ask yourself whether this is worth reading. 99% of stuff out there is not, and you want to figure that out before you spend half an hour on it. You may want to learn to speed read for this reason; if it can be speed read it's probably too shallow to be worth it.

1\. Articles and posts are the worst length for information. Tweets work great because they distill wisdom in only a few words, and super successful people have time to spare writing them. Books are ideal, because they can explore a topic inside out, whereas an article has to stop or doesn't have room to come to terms.

2\. Podcasts and videos are poor for the same reason. Elite people rarely have time to do them.

3\. In this era, it's become really common to write for the purpose of marketing a service or getting a job. Avoid places where people do this, e.g. LinkedIn, Medium, DEV.

4\. When in doubt, don't read it. If it's important, you'll see several references to the same thing.

5\. Improve your comprehension. It takes active, tiring, effort to get it up. I'd say 90% comprehension is a good goal, but even 50% is fine.

Long story short, the brain is not designed to comprehend words. It comprehends pictures great. So you want to train your brain to convert words to pictures in milliseconds. A lot of great mathematicians think in diagrams, not formulas. That way you can take on harder books.

6\. Follow what you're interested in now, don't structure it too much. A lot of books refer some interesting ideas to other books. Don't be afraid to drop a book and jump to another one. I've probably only read a few pages in Tools of Titans. Mostly it's been a reference to find better books. You also know very different things to other people; the books that fascinate you are different to the ones that fascinate others.

</comment><comment><USER3> 1\. Bookmark interesting stuff as it comes up.

2\. Review bookmarks whenever you're bored, have some down time or just feel like it.

3\. Only stick with material that you find engaging or is somehow essential to a larger project that you're working on. Happily discard stuff that doesn't grab your attention anymore.

4\. When it comes to more well defined projects and goals, having a Trello board is really helpful. Around January I made a board with books, tutorials and courses that I wanted to cover this year - tracking my progress there and keeping things up to date has worked out great so far.

5\. Don't aim to record, consume and retain everything, don't measure your own efficiency and don't call it an "information distillation pipeline" \- you're not a machine, you're just a person reading stuff online, presumably for your own benefit and enjoyment.

</comment><comment><USER4> > Many of the things I added I lost interest in because too much time passed,

That is great. Fewer things that you need to pay attention to. In fact, this kind of attrition is a _great_ way to reduce the burden. You only want to invest your effort in those things whose value to you are not ephemeral. Check out "It's not what you read, it's what you ignore" by Scott Hanselman [https://www.hanselman.com/blog/ItsNotWhatYouReadItsWhatYouIg...](https://www.hanselman.com/blog/ItsNotWhatYouReadItsWhatYouIgnoreVideoOfScottHanselmansPersonalProductivityTips.aspx)

> How do you decide what is worth reading deeper into, spending more time on, > etc?

That really depends on your goals, the topic, your background, etc.

> Do you record them somewhere? A diary? A mind map? [...] When I take notes I > struggle to organize them and make them easily searchable for posteriority.

I tend to take lots of notes in Markdown files. Recently I've been playing around with Org mode in Emacs with the "Deft" interface. It's full-text fast incremental search is fantastic.

> What sources do you use to learn new things and keep track of the novelties > in your field?

At some point (as a grad student) I used to subscribe to a couple of relevant arXiv categories, to skim through ~50 titles/abstracts every day. But see my link to Scott Hanselman's post above.

Also, to quote Sturgeon's law, 90% of everything is crap. And, (as Knuth says) I would rather get to the bottom of things than stay on top of things. So, I consider it more important to invest time/effort into understanding thigns in depth, rather than following every little gust of wind.

The questions are too broad, so it's difficult to give a useful answer. Feel free to reach out to me via the email listen in my profile if you would like to discuss this more specifically.

> When I have time I try to consume some of the stuff I save. Yet it feels > like I'm not making any good use of the information I'm putting into my > brain.

I think "consumption" is the wrong thing to aim for.

</comment><comment><USER5> I tend to focus on two types of value: entertainment stuff and actually- useful-for-my-job stuff.

A lot of what I read here on HN is the former. I'll probably never write my own compiler, but for some reason I can't resist reading an article that goes into gross detail about a 3% speed up in the Rust compiler. I don't sweat retaining the info I read. At best it's stuff to discuss around the lunch table with colleagues.

Then there are things that are truly useful for what I'm working on day to day. However, like with the pure entertainment stuff, I don't sweat about retaining everything I've read and putting it to good use. The reason is that there's a simple rule I try to follow - things that are important keep bubbling up. If we've got a problem and we need to fix something, then I'll dive extremely deep into reading about the problem we've got, and I'll put the stuff I read into practice _immediately_. By doing so I'll learn a lot and retain a lot. If I read an article that I think is interesting and could be useful _someday_ I might file a github issue to remind me to follow up, but usually not. Usually it's fine to let it go and dig in if and when there's a real problem.

</comment><comment><USER6> I'm pretty sure I'm in the minority among HN crowd, but I don't do any of this. I still read a lot of articles and links. When I find something interesting I tend to read it immediately. (guilty of taking time to read during work; though some of these are work-related, some not.)

After I read it I roughly remember the topic, though not the details. At a later point if a conversation comes up or if something at work relates to that content, I roughly remember something about it, then google (or DDG if you prefer) for the piece again with some keywords I remember.

This has served me quite well for many many years and I don't really spend any of the time most people here spend with note-taking and maintaining a personal knowledge base. There were a few times I can remember myself failing to google a piece I wanted because I either can't remember enough keywords from it or the article is too obscure to find, but majority of the time I'm ok.

</comment><comment><USER7> RSS and Notion have made me much more positive about this problem recently.

I've found a nice RSS reader I like on my phone and use it to follow HN, blogs, newspaper, podcasts etc. There is only one opening/start in the pipeline. I don't really read twitter anymore.

I open a reading list on my phone's browser and use open tabs as a todo. I lose interest in some too but I don't worry about that any more.

If I hear something interesting in a podcast I note it down in a collection in Notion while I listen.

After reading a book, paper or long article I copy my highlights into notion and summarise them over the course of a few weeks on my commute.

I also keep a notion table of unread books and use that to plan what I read on my ebook reader next.

I also gather information relevant to work in there. Links to docs or notes for my next 1:1.

With many of the notes I never return but I find the writing, summarising and organising helps me remember what I've read.

I think I take notes to remember things but i'm not really sure anymore.

</comment><comment><USER8> Possibly useful:

[https://zettelkasten.de/posts/collectors- fallacy/](https://zettelkasten.de/posts/collectors-fallacy/)

</comment><comment><USER9> I have tons of good bookmarks I have let grow stale.

If I really wanted to do something, I would probably put together my own mind mapping type explorer that would tie together top level tags down to detailed tags so I could find something different ways.

If the information is really important, I write it down in a journal.

</comment><comment><USER10> I have the same problem. I bookmark a lot and never come back. I lose interest in some of them, which I think is good, because I can focus on what's left. But even that is too much.

The best way for me to learn is blogging. I usually study a topic first and then explain it to others.

</comment><comment><USER11> I have an inbuilt system to handle this: I read the article, and if I later remember it then it was important and if I forget then it wasn't. Works well enough with minimal overhead, can't remember any important thing I've missed ;)</comment>


Creating a Collaborative Editor - <AUTHOR> https://www.pierrehedkvist.com/posts/1-creating-a-collaborative-editor <comment><USER2> That's an interesting project and good writeup!

Peer-to-peer OT has indeed been proven wrong many times (I've debunked a few papers myself as well), but client-server-based OT is very solid.

For the last 3 years, I've been the primary developer on Webstrates[1], an open source[2] research project that "makes the DOM collaborative", that is to say, as Google Docs (and your project) makes text editing collaborative (a subset of the DOM), Webstrate aims to make the entire DOM collaborative, allowing developers to easily built collaborative tools (such as text editors).

In fact, I just made a basic editor here ([https://demo.webstrates.net/dom- editor/](https://demo.webstrates.net/dom-editor/)) in about 5 seconds. I just created a new webstrate (a "page" on the server) and added the `contenteditable` attribute to the body element. Of course, it dosen't have any of the rich text editing capabilities of your editor, but that's just a matter of adding more stuff directly in the DOM, e.g. [https://demo.webstrates.net/shaggy- elephant-60/?copy](https://demo.webstrates.net/shaggy-elephant-60/?copy).

Through those 3 years, there haven't been any DOM consistency errors caused by issues with the OT algorithm used.

Absolutely nothing wrong with CRDT – it's even on our own agenda to eventually develop a peer-to-peer-basd Webstrates using CRDT. I just wanted to point out that OT is a very viable alternative for client-server applications.

[1] [https://webstrates.net/](https://webstrates.net/), [2] [https://github.com/Webstrates/Webstrates](https://github.com/Webstrates/Webstrates)

</comment><comment><USER3> > Operational Transformation (OT) is one of those algorithms, which have been > evolving over time, as versions of it have been proven incorrect.

Source or explanation required.

Also, this: [https://arxiv.org/abs/1905.01302](https://arxiv.org/abs/1905.01302)

I guess that you can argue for both sides :). But they are just different solutions. Basing on my experience and on what I read it is simply unfair saying that one is incorrect and other is correct (or one is better and the other is worse).

<comment><USER4> I think the original statement is defensible. Many of the original OT papers proposed algorithms that have since been shown not to converge in particular cases (especially the TP2 puzzle). It took a while for the fog to clear, in part because TP2 requires concurrent edits from 3 peers.

I also highly recommend the talk "CRDTs and the Quest for Distributed Consistency"[0] from Martin Kleppmann, which I believe surveys the landscape in as clear and accessible a manner as I've seen; much of the literature is pretty dense.

[0]: [https://www.youtube.com/watch?v=B5NULPSiOGw](https://www.youtube.com/watch?v=B5NULPSiOGw)

</comment></comment><comment><USER5> If you're interested in this subject, definitely make sure you check out the xi-editor retrospective: [https://github.com/xi-editor/xi- editor/issues/1187#issuecomm...](https://github.com/xi-editor/xi- editor/issues/1187#issuecomment-491473599)

</comment><comment><USER6> I'm confused here, Quill has a a very nice OT solution built-in to solve collaborative issue: [https://github.com/quilljs/delta](https://github.com/quilljs/delta)

Why not leverage that solution than just saying OT is _incorrect_ and roll out a rudimentary solution? CRDT is not something easier, OT and CRDT are just 2 different beasts with different trade-offs.

<comment><AUTHOR> Maybe I should clarify. From my understanding OT is correct when used with a client-server model. But if you have read the research a lot has happened since the first OT paper was published. The OT algortihm works well even for Google Docs and other open source solutions.

</comment></comment><comment><USER7> I took a different approach btw building collaborative editing in WordPress core editor. Knowing about OT/CRDT but decided to go with the approach here: [https://github.com/WordPress/gutenberg/pull/1877](https://github.com/WordPress/gutenberg/pull/1877)

Might be useful to you as this is react/redux.

</comment><comment><USER8> My Bachelor Thesis was implementing an operational transformation algorithm for tree structures (JSON objects) and evaluate it. Always thought about going back to it and build it into a usable application.

<comment><USER9> I think you would find willing collaborators! <3

Cool thesis. Pretty significant job :)

<comment><USER8> The algorithm already existed I just implemented it in js with a node server.

<comment><USER9> Still! :)</comment></comment></comment></comment>


The Booth Multiplier, HEC-1 and the worlds first floppy - <AUTHOR> http://www.bbc.co.uk/news/technology-35924858 <comment><USER2> Here is his paper describing the principles of computing, as it was in 1947: [http://bobmackay.com/Booth/Booth.html](http://bobmackay.com/Booth/Booth.html).</comment>


First ASUS ultrabook to market: meet the Zenbook - <AUTHOR> http://arstechnica.com/gadgets/news/2011/10/first-ultrabook-to-market-meet-the-asus-zenbook.ars <comment><USER2> Performance feature page is amusing with all the "Fruit Brand" and "A Brand" comparisons: <http://zenbook.asus.com/product/?c=4>

</comment><comment><USER3> Is there any way in which this is not effectively a "MacBook Air with Windows preinstalled"? Any realistic difference from Air+BootCamp?

Features seem the same, style seems nearly identical just Asus branded...

I'm honestly not trolling, believe me I'm far from an Apple fanboi. I just don't see where the innovation is here, apart from an "us too" from Intel & ASUS.

<comment><USER4> The term "ultrabook" was invented by Intel as a label for the MacBook Air knockoffs they wanted to entice other companies to make, so obviously the first generation will be pretty similar to the MBA.

All the differences so far seem to be minor:

\- The 13" Asus has a wider screen than the 13" MBA

\- The MBA supports 802.11a and 5Ghz for 802.11n

\- The Asus has USB3.0, the MBA has Thunderbolt

\- at 13", the Asus is a bit lighter, but at 11" the MBA is a bit lighter

\- The MBA claims much higher standby times (30 vs 10 days)

\- At certain price points, the Asus offers more RAM or SSD space, and the option of a slightly faster processor.

\- The trackpads might have significant differences

\- The Asus screens are specced to be brighter (450 nits) than the MBA screens have been measured at (350-380 nits), but specified brightness can't be directly compared against real-world measurements, and viewing angles are more important for small portable devices.

<comment><USER3> _label for the MacBook Air knockoffs they wanted to entice other companies to make_

I guess that's why I'm wondering why this laptop is HN front page news. Which is not to say that I think it _shouldn't be_ , it's just that I'm not sure why its generating upvotey excitement.

<comment><USER4> Regardless of _why_ Asus released this laptop, it's still pretty much the first direct competition for the MacBook Air, which is significant. It means that other companies are starting to agree with Apple that mobility is important, but that netbooks suck.

</comment></comment></comment></comment><comment><USER5> i wish these were actually available to buy today like asus said they would be. i've been awaiting the release of the ux21 to see if it would be more compatible with other free operating systems since my 2011 macbook air is not (yes, it boots and runs, but not well).

<http://zenbook.asus.com/where_to_buy/?cd=n-am> lists a bunch of retailers but all of them except adorama's site come up with 404s or errors saying there are no products found. i called adorama to see if the stock listed was actually ready to ship and they're closed for the jewish holiday until the 24th.

<comment><USER6> [http://www.newegg.com/Product/ProductList.aspx?Submit=ENE...](http://www.newegg.com/Product/ProductList.aspx?Submit=ENE&DEPA=0&Order=BESTMATCH&Description=AsusUX)

<http://amzn.to/qO0Inx>

<comment><USER5> newegg only has 2 of the 5 models available (neither being the one i'm looking for) and amazon is just listing adorama's stock, which is not really available.

</comment></comment></comment><comment><USER7> How much would it cost without Windows preinstalled? Will they even sell it without and OS?

</comment><comment><USER8> My dad lives in singapore and sent me a list of laptops his computer guy sent him. They all had Core i7s and platter hard drives and weighed a ton with mediocre battery life.

All my dad wants is a light laptop with good battery life to email people and surf the web on. He doesn't care about hard drive space or the graphics card. The spec lists were long and confusing.

I compared it to the Macbook Air I just bought. It was cheaper than the options he sent, lighter than the options he sent and had an SSD. It will do everything he needs and wants from his laptop better than the other options.

Then I saw this zenbook. It seems to be pretty similarly specced and is targeted at the windows market. Hopefully he can hold out until they have it there, or pick one up in the US. Kudos to the rest of the manufacturers for competing with the Macbook Air.

</comment><comment><USER9> Too bad the display is glossy. I tried it for over a year, but I can work much better on a matte screen.

</comment><comment><USER10> Oh great another ultra thin laptop with a glossy screen that will probably last 1-2 years until you buy another one that is even thinner and the screen so shiny you can use it as a shaving mirror. Give me a laptop that will last me more than 2 years and then I will give a damn.

</comment><comment><USER11> Looks great! Is it still a hostage to Microsoft?

<comment><USER12> Why are ultrabooks more expensive rather than cheap, are SSDs too costly?

<comment><USER13> Because they're not being sold by weight or by volume.

</comment></comment></comment><comment><USER14> Power button above the backspace button? WTF?

<comment><USER15> That's how it is on the MacBook Air so Asus had to copy it. On OSX there is accentual key press detection so hitting it by mistake is no big deal. Nothing happens.</comment></comment>


Amazon caught using indepdent artist's work without license - <AUTHOR> https://twitter.com/16pxl/status/1203001775852179458 <comment><USER2> Seems so difficult to maintain ownership of a digital image asset. As soon as you distribute on a website that isn't built for creatives and does nit have a heavy watermark it's free for anyone to grab. Even as a big company how do you audit someone's work for plagiarism if you hire a designer?

<comment><USER3> Tin Eye or other reverse image searches would be table stakes. Just because something is out there on the internet doesn't mean its free for commecial use.

Further hiring a contractor doesn't shield you from liability for copyright infringement although it's a good argument it wasn't willful.

</comment></comment><comment><USER4> they're not the same image it looks like (I dont see the exact overlap of amazon clouds the way her image is setup). You could make an argument for palette choice but i feel as if you shouldn't really be able to copyright pallete (though i do know you can trademark colors like UPS brown, which im not really happy about). Also this artist does pixel art which is pretty standard style, so there is a good chance someone could make something similar on their own without having look at her work.

<comment><USER5> It's not the same image, but the color choices (palette) seem remarkably similar.

If someone take a famous photograph of El Capitan and I go over and try to figure out the exact time of day and spot it was taken from and hope for the same weather and lo I'm lucky... I don't believe I'd be infringing.... but who knows... cuz if I draw a mouse and it looks eerily like Mickey...

</comment></comment><comment><USER6> This is exactly what we need, 'Blurred Lines' Lawsuit for similar "feel" and "sound" of pixel art images ...

</comment><comment><USER7> The most telling tweet here IMO:

> lmao gofundme: help me sue Jeff Bezos</comment>