What is Stack Overflow's business model? - <AUTHOR> http://meta.stackoverflow.com/questions/79435/what-is-stack-overflows-business-model <comment><USER2> Experts-exchange faces the same problem in StackOverflow that the proprietary UNIX vendors confronted in Red Hat and Cygnus.

The open source vendors were perfectly happy to turn a hundred billion dollar industry into a one billion dollar industry, as long as they sat on top of the smaller stack.

StackOverflow is clearly happy with a large piece of a smaller pie, and the "evil hyphen guys" are never going to be able to compete with that.

<comment><USER3> I'm not so sure SO will lead to a smaller pie. The walled nature of EE limited its appeal to the largest part of the audience (the people looking for answers). So although their business model was more direct, they were basing it on a smaller corpus, with fewer viewers. An indirect (advertising-based) model over a much larger number of eyeballs could well make for a larger pie.

The challenge for SO is to see if they can maintain a high quality corpus as they scale, so people will keep producing and consuming their answers.

<comment><USER4> In my opinion, SO's main competition is technical forums and _not_ EE. So while SO takes away from other Q&A sites, they're also taking forum traffic and monetizing it better.

</comment></comment></comment><comment><USER5> Reading through the comments on Meta StackOverflow to the question, two things become really obvious to me.

1\. I'm so used to the hyper-insightful Hacker News business users that the many of the SO responses seem very idealistic. In other words, I get the impression that a lot of them are coders who think the world 'should work a certain way' but have no real business experience.

2\. SO isn't making much money and isn't too keen on telling what their business model, if there is one, actually is.

<comment><USER6> As to your point number 2, the top upvoted answer to that question is by one of the founders who clearly states the three ways that they are making money.

<comment><USER5> Yes, he says, 'here's how we bring in revenue, and you should be able to do the math'.

I'd say he avoided the actual question rather deftly, which is how SO is going to scale from a traffic and ad site to a site that brings in the kind of money that VC's want.

<comment><USER6> I think there is a real mistake in all of this discussion in conflating StackOverflow and StackExchange.

What StackOverflow did to Experts-exchange, StackExchange is trying to do to Demand Media/eHow, and they seem to be trying to do it the same way by building a better product and providing better answers.

<comment><USER7> _StackExchange is trying to do to Demand Media/eHow_

Not quite. They're pretty big on focusing only on topics where meaningful questions have right answers, as opposed to (I swear this is an actual eHow page) How To Pour Water Into A Glass.

<comment><USER8> You know, just last night I just looked up "how to flip an egg" and ended up reading a Wikihow article. I can flip pancakes great sans spatula, you see, but doing a decent egg over easy continues to elude me.

I could see someone trying to look up tricks to pouring water without spilling it, maybe. Never thought I'd say that, though.

<comment><USER9> There's almost always a Youtube video for things like that. It's actually pretty impressive how many useful "how-to" videos there are on there.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Developer recruitment is a $2bn/year market in the US alone.

SO's currently making about $150k/month from job listings on a tiny fraction of the market.

<comment><USER11> Do you have a source for that $2bn/year ?

Best I could do was this: [http://www.linkedin.com/answers/hiring-human- resources/staff...](http://www.linkedin.com/answers/hiring-human- resources/staffing-recruiting/HRH_SFF/496369-46631227)

$2bn just for finding developers (that must include non-programmers) sounds plausible, didn't realize recruitment is such a large industry.

<comment><USER10> My own models based upon several sets of data (I run a startup in this space).

But roughly it comes down to 320k developers changing jobs every year * an average spend of $9000 on recruitment costs.

</comment></comment></comment><comment><USER12> I do wonder whether Stack Overflow will become a victim of their own success. By providing a place to get answers from experts to technical questions, actually _employing_ an expert is worth much less than before. In other words, Stack Overflow is turning knowledge into a commodity. This makes experts less valuable in the marketplace. It therefore makes running a job-listings page (or "elite CV service") less profitable.

Furthermore, since SO profiles are public, other job-listing companies in the market can easily leach off the reputation mechanism just by adding a "Stack Overflow profile" field.

Stack Overflow is a wonderful site, but I think their free services are a long-term threat to the profitability of their premium services. When knowledge is free, there's no reason to employ an expert.

<comment><USER13> Take 10 master wood workers and put them in a room, give a low-skill wood worker all the tools they need and the ability to ask any of the masters any question they like at any time and get the answer.

Do you think this will result in the same quality of work as if a master wood worker had done it?

Why would you imagine software to be so different?

Being able to get past any particular technical speed bump is a tiny part of what makes a more experienced developer valuable.

</comment></comment><comment><USER14> They also seem to be making money from inserting amazon affiliate tags to links pointing to amazon.

Example: [http://stackoverflow.com/questions/90924/what-is-the-best- ph...](http://stackoverflow.com/questions/90924/what-is-the-best-php- programming-book/1729361#1729361)

</comment><comment><USER13> They have lots of traffic, they serve ads, they charge for job listings. It shouldn't take a rocket scientist to do the math on that and figure out how they make money.

<comment><USER15> Why not just limit your response to the first sentence? Moreover, I work with a rocket scientist and I'm not sure he could figure it out.

<comment><USER13> It's not necessarily trivial to monetize lots of traffic (see 4chan, for example).

<comment><USER6> This is an excellent point and SO has previously stated (Pre VC) that they've had issues with doing so in part because of the community.

I can specifically recall them describing how their attempts to do Amazon Affiliate sales of books on the site were being undermined by people removing the affiliate codes from the links.

<comment><USER16> Unless the links are being provided by a source that the user dislikes, why would anyone choose to strip out the affiliate part of the URL?

It doesn't increase the cost of the item (afaik), and provides the source with some revenue.

</comment></comment></comment></comment></comment><comment><USER17> I think their business model is to be a trusted source of information. My problems with Google and Bing are that for some topics the top results are mostly spam. I get eHow sites or other spam sites. What I want are trusted sources of information. Their business model is vertical search.

<comment><USER18> That's not a business model. A business model would be monetizing being a trusted source of information. How do you do that? Google use adverts, Experts Exchange charge admittance, are there other options?

<comment><USER17> I didn't look up the technical definition of "business model" but it's pretty clear to me that their goal is to dominate vertical search and be a trusted source of information.

They are following the same path Google did. When Google started the didn't know how exactly they'd make their money. Their goal was to be the best (and least intrusive) search and monetize later. Being the primary, trusted source of information in a bunch of vertical search areas has obvious value.

One potential avenue is to become a sort of university. They know the areas that people are asking lots of questions about and could setup a course to cover the topic. They don't actually have to be the ones to setup the course. They have the information to sell to someone who would setup the course.

The preceding is just an example of how being the leader, that is having the information, is the business model (or goal if you will). Trusted information has value.

<comment><USER4> Having something of value isn't business model in and of itself.

If SO doesn't monetize their traffic _somehow_ , they'll go bankrupt despite providing value to their users.

</comment></comment></comment></comment><comment><USER19> every one of our great investments elicited this question early on. i'm pleased to see that Stack is generating the same kind of questions

</comment><comment><USER20> Does anyone know if they make money off branded tags? (see their android, flash, visualstudio tags)

<comment><USER21> Read this: [http://meta.stackoverflow.com/questions/23955/adobe- sponsore...](http://meta.stackoverflow.com/questions/23955/adobe-sponsored- tags)</comment></comment>


Machine learning project ideas to do in a newspapaper? - <AUTHOR> <comment><USER2> Clarify: you want to analyze newspaper data? Or you want to do a machine learning project that would make a good newspaper article? Or you want to write a how-to ML article that fits into your newspaper?

<comment><AUTHOR> Option A. I work for a newspaper and I am looking for ideas about what do to with the data. Thanks for asking! :)

<comment><USER2> How about this. A crossword puzzle generator. The user enters a keyword, a person's name, or a date, and your program generates themes, words, and clues associated with that prompt in the newspaper archives. So for example, if I enter the keyword "Trump", your algorithm does some word-association magic (I'm not big on the terminology when it comes to text data) and comes up with a bunch of words and clues drawn from your paper's archive of writing about Mr. Trump...</comment></comment></comment>


Princeton under investigation after president deems racism 'embedded' in school - <AUTHOR> https://www.washingtonexaminer.com/opinion/exclusive-education-department-opens-investigation-into-princeton-university-after-president-deems-racism-embedded-in-the-school <comment><AUTHOR> The New York Times also has an article [1], but interestingly, they used "Princeton Admitted _Past_ Racism" in the title. Only in the 6th paragraph do they correct the misleading impression of the title and mention that he was referring to _present_ racism as well.

[1] [https://www.nytimes.com/2020/09/17/us/princeton-racism- feder...](https://www.nytimes.com/2020/09/17/us/princeton-racism-federal- investigation.html)

</comment><comment><USER2> This is some really great trolling by the Department of Education.

It amazes me that elite institutions like Princeton were so quick to come out and call themselves racist. Aren't they opening themselves up to endless lawsuits by saying that?

<comment><USER3> I don't think it is even trolling, DoE has a legal obligation to investigate.</comment></comment>


Rust Compile Times Are Not Slow - <AUTHOR> https://wiki.alopex.li/RustCompileTimesAreNotSlow <comment><USER2> So... is the conclusion here that Rust compiles at about the same speed as webpack? Because that doesn't quite support the claim in the title...</comment>


Why Does Apple Still Have An IE6 Screenshot on its Quicktime Download Page? - <AUTHOR> http://www.apple.com/quicktime/download/

<comment><USER2> They like to show Window's in an obsolete manor, that or they aren't bothered to change it.

I don't know if you noticed but the icon for a networked windows pc in the Finder is actually a pc with the blue screen of death :P (I find that a little unprofessional of Apple tbh tho)

<comment><USER3> It's kind of an easter egg since most users will never notice unless it's the few people that make their Finder icons absolutely huge. It's definitely just to poke fun and since it isn't in anyone's face, it's not that unprofessional.

</comment></comment><comment><AUTHOR> You need to access the link from a Windows machine. Even on Windows 7, an IE6 screenshot shows up.

</comment><comment><USER4> Looks like Safari on a Mac to me

<comment><USER5> What windows users see:

[http://images.apple.com/quicktime/download/images/hero- pc-20...](http://images.apple.com/quicktime/download/images/hero- pc-20100501.png)

<comment><USER4> I notice the contents are misaligned too...

</comment></comment></comment><comment><USER6> They want it to look exactly as most Windows users will see it.

<comment><USER7> Ummm.

<http://www.theie6countdown.com/>

</comment></comment><comment><USER8> Who uses QuickTime anyways? Nobody cares about it. Quite frankly, I haven't noticed it while looking at this page an hour ago.</comment>


Hy - <AUTHOR> https://en.wikipedia.org/wiki/Hy <comment><USER2> I love Hy. I played around with it 3 years ago. Development has been super active since then: [https://github.com/hylang/hy](https://github.com/hylang/hy)

Don't know if it's still the case, but the Hy project had the most puns I've seen in one repo. In a good way.

Here are two previous discussions:

[https://news.ycombinator.com/item?id=8696975](https://news.ycombinator.com/item?id=8696975)

[https://news.ycombinator.com/item?id=7214400](https://news.ycombinator.com/item?id=7214400)

</comment><comment><USER3> Pros

* Runs anywhere Python does

* Uses Python's ecosystem

* LISP consistency and functionality

Cons

* As slow as Python

Conclusion:

I love Hy. When I want a portable LISP, or get incredibly frustrated with Python's arbitary limitations (lambda), I use Hy.

Unfortunately, never had it fit a large project, so I use it like scsh.

<comment><USER4> I do not agree that Hy has "LISP [sic] consistency and functionality". The code visually resembles Lisp but consists of ugly hackery under the hood.

Straight from the doc:

 _" In some Lisp variants, the cons cell is the fundamental building block, and S-expressions are actually represented as linked lists of cons cells. This is not the case in Hy, as the usual expressions are made of Python lists wrapped in a HyExpression. However, the HyCons mimics the behavior of "usual" Lisp variants thusly:_

      * (cons something nil) is (HyExpression [something])
      * (cons something some-list) is ((type some-list) (+ [something] some-list))

_(if some-list inherits from list) [... etc] "_

Basically, yikes!

</comment></comment><comment><USER5> This looks great. The compactness reminds me of Arc, with the bonus of having all of python's libs.</comment>


An idea for an iphone app to combat the swine flu. - <AUTHOR>

The idea is that you would inform the app any time you see someone who sneezes or coughs or looks sick.  The app would combine this tip along with your current location.
In this way, you can still leave your house but avoid areas where sick people were seen recently.
You can make it more sophisticated by indicating what this person looks like, where this person is going, the density of people around him/her, whether he/she is indoors, etc. <comment><USER2> This is a horrible idea. However, since I've worked in "bio defense" and have family members who still do, I can assure you that if you write the grant proposal properly you should be able to pick up some US federal dollars to work on this. Possibly to the tune of hundreds of thousands of dollars.

You don't even ever have to finish it - you just need to write the reports at the proper times.

</cynicism>

</comment><comment><USER3> Come on, it's the _flu_. You can _leave your house_ for god sakes. Especially in the U.S. where there have been barely any reported cases (wait, any?)! How about this idea for an iphone app: iPaperBag. You breathe into it to stop hyperventilating over swine flu.

<comment><USER4> I last read about 100 un(?)confirmed cases for the US but I still agree with this. It's a novel idea, and certainly a topical one, but does nothing to help the scaremongering dealt out by the media.

</comment></comment><comment><USER5> There's an app for that. (Well not quite as described, but similar) [http://www.techcrunch.com/2009/04/30/want-to-avoid-swine- flu...](http://www.techcrunch.com/2009/04/30/want-to-avoid-swine-flu-theres- an-app-for-that-too/)</comment>


IBM is making a quantum computer available for anyone to play with - <AUTHOR> http://www.economist.com/news/science-and-technology/21698234-ibm-making-quantum-computer-available-anyone-play-now-try <comment><USER2> > A run-of-the-mill laptop can simulate quantum computers with as many as 40 > or 50 qubits

This got me to wondering if there's a readily-available quantum computer emulator or something of the kind, and it turns out there's even one built with JS and WebGL![0] This seems really interesting if you want to learn more about what the quantum fuss is all about.

[0]: [http://www.quantumplayground.net](http://www.quantumplayground.net)

<comment><USER3> There's also _drag-and-drop_ in-browser circuit simulators, which can be a bit more approachable than the quantum computing playground's scripting UI.

Davy Wybiral's simulator: [http://www.davyw.com/quantum/](http://www.davyw.com/quantum/)

Quirk (my simulator): [http://algorithmicassertions.com/quirk](http://algorithmicassertions.com/quirk)

Of course you'll still be lost if you have no context for what a quantum computer _even is_. For that there's the youtube series Quantum Computing for the Determined ( [https://www.youtube.com/playlist?list=PL1826E60FD05B44E4](https://www.youtube.com/playlist?list=PL1826E60FD05B44E4) ). It's by the co-author of the de-facto textbook for the field, and done in a Khan Academy style.

</comment></comment><comment><USER4> Can anyone explain how programming in a quantum computer environment differs from a traditional environment? The scripting examples look pretty familiar to what you would see in programming today.

</comment><comment><USER5> Dibs on the first web framework.

<comment><USER6> Qubits on Quails?

<comment><USER5> Quango?

<comment><USER7> Query?

<comment><USER8> QuoVadis as the authn framework

</comment></comment></comment></comment></comment><comment><USER9> IBM seems to mainly be generating vacuous news buzzwords.</comment>


Goldman Goes Rogue – Special European Audit To Follow - <AUTHOR> http://baselinescenario.com/2010/02/14/goldman-goes-rogue-%E2%80%93-special-european-audit-to-follow/

<comment><USER2> For those that read the article and not the comments, the following link was provided to rebut the idea that reporting from Der Spiegel and the Times was uncovering something previously secret:

[http://www.risk.net/risk- magazine/feature/1498135/revealed-g...](http://www.risk.net/risk- magazine/feature/1498135/revealed-goldman-sachs-mega-deal-greece)

The question here is not what Goldman did wrong but why the ECB didn't take any action when this really was news.

<comment><USER3> Sounds like a need for more transparency on swaps and swap accounting, not more Bank bashing..</comment></comment>


Securing PostgreSQL [pdf] - <AUTHOR> http://thebuild.com/presentations/pgconfeu-2016-securing-postgresql.pdf <comment><USER2> > Use a well-known secure algorithm (AES256 is considered the standard).

> Never roll your own crypto.

Directly using a primitive like AES is pretty much rolling your own crypto. (Creating an actual cipher and using it is just beyond ridiculous.)

What you should use is secretbox from NaCl (libsodium or tweetnacl). Or Keyczar, I guess that's still maintained (last commit on github is 21 days ago). Or TripleSec for long term things that you're really really paranoid about.

The point is, use a library that does _authenticated_ encryption for you.

<comment><USER3> Why is using AES-256 directly considered "bad"? Is the issue key management? RNG? Padding? Or what exactly? Genuine question.

Or do you mean that _re-implementing_ AES-256 in your own library instead of using a well-tested implementation is "bad"?

<comment><USER4> You can get a good example of this by simply hitting this link and reviewing the first few hits:

[https://github.com/search?utf8=%E2%9C%93&q=aes+encryption](https://github.com/search?utf8=%E2%9C%93&q=aes+encryption)

I'm not going to call out any project by name, but on the first few pages, I see:

\- A project which implements unauthenticated CBC mode AES

\- A project that does not, in any way, document its mode or implementation beyond "using AES 256"

\- A project with <10 commits, more than two years ago, yet over 50 stars

\- A project that uses mcrypt

Over all, it is easier to find a project with horrible deficiencies than anything that didn't immediately look concerning. And every one of these boasts "AES 256 encryption".

<comment><USER5> What is wrong with mcrypt?

<comment><USER4> I started writing an answer, but this blog is more comprehensive than anything I could put together:

[https://paragonie.com/blog/2015/05/if-you-re-typing-word- mcr...](https://paragonie.com/blog/2015/05/if-you-re-typing-word-mcrypt-into- your-code-you-re-doing-it-wrong)

Problem #2 is something I've hit in multiple real-world codebases.

</comment></comment></comment></comment></comment><comment><USER6> I have a question about storing the encryption keys. How would one actually securely store them and distribute them among the application servers in a cloud environment.

I don't buy into the 12-factor-application way of storing sensitive data in an environment variable ("ps ae" and a local intruder has the data).

Storing it in a secured file on the server requires the file to be distributed by the provisioning service, thus implying the key being stored in a repository (that just isn't your application code, but a repository none the less).

Using an api service to with client certificates doesn't really help either, because if the application code can access the required configuration and certificates, so can an intruder with shell access (since the intruder most likely has the user permissions of the running application before doing a privilege escalation attack).

I haven't seen an answer to that question that really satisfied me in the past. Does anyone have a battle tested method for storing database encryption keys?

<comment><USER7> > Using an api service to with client certificates doesn't really help either, > because if the application code can access the required configuration and > certificates, so can an intruder with shell access (since the intruder most > likely has the user permissions of the running application before doing a > privilege escalation attack).

The problem here is that if your application requires the use of encryption keys, and the user which runs this application gets compromised, you have a problem anyway - since like most applications, yours probably also doesn't care about the key's security once it's in memory. If they get that far, the only thing you can do is replace/revoke those keys and take the hit.

In more secure non-cloud setups, encryption/decryption is being done by something like a HSM, a box with only one interface (usually PKCS#11) which can be used to encrypt, decrypt and sign stuff, and you never see the keys. You have software HSM's - and you could try to apply the same principal in the cloud, where you have an isolated box with only the very well protected and audited soft HSM running.

But not sure the cost of learning and maintaining such a system is worth it for most situations, where I would use an API service like Hashicorp's Vault. Most of the compromising of keys and secrets doesn't happen on your servers, but on your or some developer/user's work machine. How many crap is exchanged over email, dropbox links, slack, skype, ...? Keeping keys out of the hand of the user and eliminating the need for your users to have them at all is higher on my priority list.

</comment></comment><comment><USER8> While there is some PostgreSQL-specific things in this, the vast majority of it is pretty solid advice regardless of the database you have.

</comment><comment><USER9> The advice on FDE is misleading if not flat out wrong. It's _NOT_ just to protect against media theft. It's also about "shit, the drive crashed. How do I destroy the data on it before throwing it in the trash?"

Same with replacing a smaller drive with a bigger drive. Yes, DBAN it, but that won't take care of remapped sectors.

It's easier to destroy an encryption key than it is to destroy the data.

<comment><USER10> To the point that more recent hard drives already come with hardware encryption enabled, and the secure erase/sanitize command can finish in mere seconds, because it only needs to throw away the existing key: [https://en.wikipedia.org/wiki/Hardware- based_full_disk_encry...](https://en.wikipedia.org/wiki/Hardware- based_full_disk_encryption#Disk_sanitization)

<comment><USER11> That requires you to trust the disk to implement many finicky crypto details correctly in its proprietary black box, you can't get any assurance about that with reasonable cost. And SSDs have a horrible track record in the area, manyimplementing SECURE ERASE so it leaves your data on the flash chips. And if you choose a disk model, make your investigations and find it passes your sniff test, disks are no longer a commodity part for you.

</comment></comment></comment><comment><USER12> So true, which is why I find it kind of awkward when I say to young developers/business owners they should pay for a professional PostgreSQL hosting and they argue it's open source and they can host their DBs on a $25 (or less) Digital Ocean instance.

Until it's too late, I guess.

<comment><USER13> We (databaselabs.io) are the first Postgres as a Service on DigitalOcean. We fight this sales battle on a daily basis.

The problem is that younger devs/owners are much less likely to have ever experienced any significant outage, so it's a non-issue for them. They can't see why they should pay good money to prevent it.

We've had much better results with slightly older and more experienced people, who realize that our service is an absolute bargain compared to the cost and risk of attempting to run continuous backups, etc. themselves.

<comment><USER14> i am curious, you are commenting on a post about secure postgres but after signing up for your service i see that the database i created is publicly available, on the standard port 5432, with the default postgres username. the only thing stopping me is a password, no certificate required. i am not a postgres expert but how is this not extremely insecure?

<comment><USER13> "Extremely" insecure is a bit of an exaggeration. It's not as though the password is "password" on all the databases.

We do support certificate-based logins and firewalls with IP whitelists. They're just not on by default. Frankly, the reason is because almost all customers don't care about having a _very_ high level of security if that implies doing more work (setting up certificates, whitelisting IPs.) Moreover, they actively prefer to have "simpler and less secure" over "more complex and more secure."

We've done experiments with certificates and firewall IP whitelists and so on. Almost all customers and potential customers reject these things. They say they want a simple password that just works from anywhere.

We had to choose between being slightly less secure and having customers, versus being highly secure and having no customers. Since the business can't survive without any customers, that choice was easy.

That said, if you do want any of those things turned on for your database, just write firstname.lastname@example.com.

<comment><USER15> Out of curiosity, can one change these settings for their own databases automatically via some "control panel" or such, or does it require intervention from your staff?

Fortunately, I think there have been fewer "unauthenticated remote access" vulnerabilities with PostgreSQL than MySQL so this (being accessible from 0/0) probably isn't a huge deal. That said, I'd look for ways to restrict who can actually connect to 5432/TCP that won't negatively affect the majority of your customers (e.g., if your databases are running on DigitalOcean, can you restrict connections to that particular DO datacenter by default and provide an option to loosen those restrictions in increments -- "this datacenter", "all DO datacenters", "the world", etc.?).

<comment><USER13> These settings are currently manually operated by staff, via firstname.lastname@example.com.

That will get added to the control panel eventually, but right now as approximately zero percent of customers want those things, it's not a good use of our limited engineering time to even automate that, versus other things that engineers could be doing with their time.

While it would be nice in theory to restrict them by default, in practice there's just no restriction that's close enough to universally applicable to be workable (i.e. one that won't disrupt a large number of users' use of the database if it's applied everywhere.)

And you are correct, there are essentially zero unauthenticated remote access vulnerabilities that come out in Postgres. Combine that with:

* All connections require SSL * The password is a long string of randomly generated characters * We actively monitor the network for unusual traffic patterns

and it's actually not so bad. Not ideal of course, but very much not "extremely" insecure, as the above post said.

</comment></comment></comment></comment></comment></comment><comment><USER16> Awesome! Is the actual talk somewhere as a video?

<comment><USER17> The same talk is actually being given at PGConf Silicon Valley in just under 2 weeks ([http://www.pgconfsv.com/program](http://www.pgconfsv.com/program)). We will be recording the audio and slides there and that video will be online some weeks after. You could also always come and see it live if you're in the bay area :)

<comment><USER16> Too sad, Germany is a bit too far away. However, thanks in advance for recording, looking forward to watching it!

<comment><USER18> Me too. I would like to see the talk. Thanks for recording it.

</comment></comment></comment></comment><comment><USER19> This is solid advice. While you may not be able to do everything in the slides there are some really good practices.

</comment><comment><USER20> "For critical passwords, use split passwords with dual custody."

Could anyone comment on the practice? Does it mean that I have the first half of password and other guy has the other? We can only log in by combining password? How do we type the password in by not sharing a physical computer?

<comment><USER21> Yep! Dual custody can really just be as simple as providing two halves of the password from different owners. I've implemented similar before. Both owners having physical access tends to be the safest way, as whenever one is remote you have considerations about the password in transit. Something like tmate could help.

</comment></comment><comment><USER22> The problem with pgcrypto is the fact that in the logs there's the password? that's it? I would like to see the talk to get a better understainding of the whole message, is it available somewhere?

<comment><USER23> The fundamental issue is that you should not be exposing the encryption keys to the database. If you're using pgcrypto then you're issuing SQL statements _in the database_ with the key. You should do your encryption client-side so that the key is never passed over the wire at all.

<comment><AUTHOR> That said, pgcrypto is still useful, you can compute hashes or generate UUIDs with it.

<comment><USER24> The point was that you probably shouldn't use it for data encryption in the DB _and think the server doesn 't have the keys_.

</comment></comment></comment></comment><comment><USER25> One of the constraints I am working with is that a human is not necessarily in the loop all the time. What is the best way then bootstrap the encryption process?

<comment><USER26> You basically don't. You're adding a lot of complexity chasing after a very marginal (say, 5%†) fraction of the security application-layer crypto gets you.

You can get that fraction closer to 50% without a human in the loop by segregating your crypto code from the application in a virtual HSM, using something like a TLS client certificate to authenticate your application to the HSM, have humans in the loop for restarts/bringups of the HSM itself, and doing pretty aggressive monitoring on the request patterns between the app and the HSM.

The threat model here is that someone owns up your app server --- if that wasn't in your model, you wouldn't need application layer crypto. The idea is that owning up the app server will get an attacker enough access to make requests to the HSM, but not control of the HSM itself. If the HSM can detect abnormal volume of requests, you can use it as a circuit breaker to prevent bulk exfiltration of your secure data. You also get accountability, so that when your server is compromised you might know exactly what records were accessed.

Typically, the app server itself will handle all of the database operations, and the virtual HSM just provides a "seal" and "unseal" operation --- convert plaintext to ciphertext, convert ciphertext to plaintext.

† _The 5% you 're getting in the dumb online crypto scenario is that if you store the root crypto secrets in a file, an attacker can't necessarily recover it from an SQL injection attack --- but in reality the percentage is probably lower, since most of the time SQLI will equate to RCE._

<comment><USER25> Thanks for the response. Although not ideal, I am stuck with using crypto at the DB level. Based on what you said; running something like vault (running as a separate user from the DB) and accessing it using the HTTP API + TLS client cert seems like the way to go.

</comment></comment></comment><comment><USER27> 68 slides! This must have been an epic or fast paced conference talk. Good points. I think the comments on FDE are spot on; it's almost always about compliance. And I'm reasonably comfortable with SSH access if, and only if, it uses SSH key authentication (no password auth) and that PermitRootLogin is turned off. A Bastion host is a good idea, but "never" is a bit strong.

</comment><comment><USER28> I think this talk misses one of the most important security patterns of PostgreSQL and SQL-databases in general. If you for example have a table with hashed passwords. Why would any user except admin need to be able to make a select on that table? Make a function to validate the user and only grant permission to run this function.

<comment><USER26> That's a bad idea, because it implies that your password hash has to be expressible inside of Postgres.

If you're worried about a SQL dump exposing password hashes, segregate password validation into its own microservice. This comes with other benefits: for instance, you can ratchet up the work factor on your password hash, because the service will very easily scale horizontally.

<comment><USER28> First of all, this pattern is not exclusive to password hashes. There are lots of situation when handling customer data where you simply don't need the ability for the client to query the whole data-set, and if that's the case, allowing it is just bad hygiene.

Now if you make a good set of prepared statements as an interface for your database, this could be viewed as a "micro service" in it self.

<comment><USER26> Yes, and that's a good pattern. Just not for password hashes.

</comment></comment></comment></comment><comment><USER29> Perhaps to help others extract info: for me most of this I know or is sort of common sense at this point with the one exception of page 39: "do the encryption in your app".

I'm not saying I have ever used pgcrypto but it is important to be mindful that pg is logging stuff.</comment>


Ask HN: Resources for building a monolith that is easy to break apart? - <AUTHOR> I'm looking to start working on a few side gig ideas I've had for a while now, and while I appreciate the benefits of event driven micro service architecture at work immensely, I'm also just trying to get a few MVPs up and running without investing a ton of time fiddling around with all the stuff that comes along with well done micro services.
That being said, I've also worked at enough places where some nightmare 5 year old monolith is at the core of the business and there just never seems to be enough time or buy-in from management to break it apart and clean it up, and I'd like to avoid making the same mistakes myself.
Obviously the usual good code philosophy stuff applies - SOLID and so on, but are there any good non-obvious tips or even resources (books, talks, blog posts, etc) that you guys know of which address the approach of writing a monolithic program you expect to eventually break up into well defined micro services? <comment><USER2> Martin Fowler has a nice collection of essays & videos. He recommends starting with a monolith, then breaking out capabilities over time. He also mentions that micro services are useful as a solution for partitioning work across teams. [https://www.martinfowler.com/articles/microservices.html](https://www.martinfowler.com/articles/microservices.html)

I'm trying to figure out how to avoid having too many micro services in my team right now.</comment>


Toyota takes Elon Musk's "Bullshit" and powers a car with it - <AUTHOR> http://www.businessinsider.com/toyota-is-taking-on-the-hydrogen-car-haters--including-elon-musk-2015-4

<comment><USER2> The Elon Musk thing seems like an unnecessary tangent.

What I really want to know is: How is the hydrogen packaged? It seems like in a lot of ways hydrogen would be an incredible fuel source, since as they say in the article it burns clean and at least in theory can be refueled like oil- based products.

From my understanding hydrogen's biggest problem has been that it has to be delivered under pressure, which both makes it more dangerous/explosive, but also makes pumps and cars more expensive.

There was some talk in the mid 2000s about binding hydrogen into a chemical compound which makes it more stable, but not so stable that it is difficult to extract again (essentially giving it an diesel level of stability, rather than a water level of one). What happened to that?

Is this Toyota car another high-pressure hydrogen project or something new?

<comment><USER3> > From my understanding hydrogen's biggest problem has been that it has to be > delivered under pressure, which both makes it more dangerous/explosive, but > also makes pumps and cars more expensive.

Its biggest problem is that its not a fuel; there are no hydrogen stores on Earth, and the only way to produce it is through highly inefficient electrolysis or through cracking natural gas.

In this case, they're taking methane and producing hydrogen....when they could just burn the methane in the existing natural gas engines they've put in Camrys for god knows how long.

Showcasing a terrible technology doesn't magically make it feasible for large scale production and distribution.</comment></comment>


Why I'm Glad I Got Fired - <AUTHOR> http://blogs.hbr.org/cs/2011/03/why_im_glad_i_got_fired.html <comment><USER2> One thing I learned some years ago is to always avoid being the agent for someone else's humiliation. Even if that person is blatantly wrong, all you'll do by calling them on it is create an enemy.

One trick I've used many times to correct someone without embarrassing them is to couch my own feedback in conditionals, something like "You've been studying this a lot more than I and I'm sure you're probably right but I seem to recall reading a bit ago that an md5 sum isn't a sufficient way to hash a password, you need to do more processing."

That then gives them an out "yeah I looked into that and I'm pretty sure this is best practice but I'll check again" or somesuch. Probably 80 percent of the time, when I frame it like that, I'll see a followup saying that they've gone back and discovered the right way and will be doing it that way.

The really nice thing is that people are appreciative when you treat them that way, and far from creating a new enemy you'll have earned respect and trust from that person.

<comment><USER3> Yes! Helping people save face is more useful than jockeying for nerd dominance. Other approaches to do what you suggest:

"I think I read an article that compared a few different password hashing strategies, I'm interested in your thoughts..." (and then follow up with a good comparison that makes the point)

"Have you compared X, Y and Z?" Tone is important with this one, but it can be the most straightforward.

"At the last place I worked, the paranoid guy insisted that we do X because he thought it was better -- it was just as easy to implement, is that something you'd be open to?"

When all else fails, you can follow up in private!

I think the key in any of these exchanges is to offer new information in a way that doesn't question the judgement of the other individual. Basically, assume that everyone is rational and differences in judgement are due to differences in information/experience. Then, when someone makes a judgement different from yours, you are merely giving them the information that lead to your decision -- but leaving them to make up their own mind. Most people are more ego- identified with their judgement than with the information they have.

<comment><USER4> _"Helping people save face is more useful than jockeying for nerd dominance."_

Welcome to my quotes file.

</comment></comment></comment><comment><USER5> This is a really great article. Her experience mirrors mine in a lot of ways - not that I've ever been an executive of anything, just that I've had the experience of winning a battle at work, but winning in a way that alienated my team. A lot of technical people are like that - we know we are right, and we probably are, but when you shove the raw data and facts down your team's throat in the wrong way, people will resent you for it.

Unfortunately, a lot of people are idiots, but you can't just call them that. This is something I'm struggling with, and I wonder if anyone has pointers for me. Not that I call people an idiot, but just that, if I know my facts are correct, and I disagree with them, it's basically the same thing - you're saying "I'm right and you're wrong," which might be true. How do you get someone to agree with you without making them feel like an idiot? Please, tell me, I'm dying to know...

<comment><USER3> When you say that "people are idiots", it seems to assume that there is a thing called "intelligence." Well, there is no "g", or general intelligence that anyone can pin down.

Let's take the simple view and say that people's actions and judgements are a product of the information they have gathered, the habits they have, their ability to analyze and combine that information, their ability to optimize within constraints and their ability to recognize and evaluate constraints.

If someone is clearly wrong, then they have some bad information or bad reasoning. Learning their bad conclusion, many people then go on and do a "well, i'm right and if they heard my reasoning then of course they would agree with me!" That can work within relationships that have a high degree of trust and rapport (not most relationships.) Outside of those relationships, it is too self-centered.

Changing someone's mind is like fixing a bug in a foreign code base. You don't just look at the erroneous output in order to debug, you also look at the source and the input. Similarly, to effectively communicate with someone who disagrees with you, you should seek to understand the information and reasoning that lead them in a different path.

Understanding where they went wrong (in addition to their erroneous conclusion) gives you a great level of preparedness. When you know where they went wrong, you can usually get _them_ to change their own mind by asking them to teach you about how their model of the world is consistent even though you have seemingly contradictory information.

For instance: "oh, how is delivery guaranteed if there isn't a confirmation echo?"

Basically, you take the stance of being wrong, and "use" them to teach you about where you are wrong. If their answer seems to ignore information you have, you can ask "How does this relate to the stats they released last week?"

This "please teach me" questioning approach doesn't undermine their judgement or threaten their ego while giving you control of their thought process (or at least more insight into it, which translates to having more control ultimately.)

This takes a long time, but when you start learning to model other people's reasoning ( a skill unto itself) you will get better at asking the right question that guides them to the right conclusion without telling them what the right conclusion is.

<comment><USER6> One of my favorite videos on youtube is the one where Neil deGrasse Tyson expresses disagreement at Richard Dawkin's methods [1].

He says: "... persuasion isn't 'here are the facts and you're either an idiot or you're not.' It's 'here are the facts and here's a sensitivity to your state of mind.' And it's the facts and the sensitivity that when convolved together, creates impact. I worry that your methods and how articulately barbed you can be, simply being ineffective..."

[1] <http://www.youtube.com/watch?v=-_2xGIwQfik>

</comment></comment></comment><comment><USER7> For some reason, I kept thinking of how this headline would read if it was an Onion article.

"Soulless executive loses job, discovers she's a human being."

</comment><comment><USER8> I have always supported a philosophy of patience when it comes to being right. When entering a new organization, make your case(s) known, but don't push them. If you are proven to be often correct, over time people will see the pattern, and you will earn respect. Even more so if you don't say "I told you so." On the flip side, if you are pushy and turn out to be wrong, you just shot yourself.

<comment><USER9> Eh, I dunno how much my experience confirms this. I worked for a pretty spastic, rudderless company for awhile. I'd make my case for the right direction. I'd be shouted down.

Months later, exactly what I described would be pitched as a new direction, as though it was someone else's idea (and it definitely _was_ their idea, for all practical purposes – I wasn't listened to, so they got there independently). This repeated itself a few times.

Now I work somewhere else and it's much better. I'm still not a dick. But maybe the lesson is that if you're continually in disagreement and no one is listening, you're in the wrong place.

<comment><USER10> _Now I work somewhere else and it's much better. I'm still not a dick. But maybe the lesson is that if you're continually in disagreement and no one is listening, you're in the wrong place._

It's good that you're sticking by your principles. These sorts of matters are a two-way street after all-if the other side isn't willing to work as hard as you in seeing eye to eye, then it's time to leave as you did. The trouble I always have is deciding when enough is enough.

</comment></comment></comment><comment><USER11> "You got it done, but they'll never work with you again." is only about a half-notch up from "You didn't get it done."

There will always be a next time, and people never go away.

</comment><comment><USER12> Reminds me of a Stephen Covey quote that goes something like:

"In any situation you can either be right or you can be kind. It is better to be kind."

<comment><USER13> It depends.... critical decisions you need to be right for. 99% of decisions, it's probably better to listen to that advice.

</comment></comment><comment><USER14> Dear HBR:

If you're going to place a pop-over ad for the iPad HBR app, please make sure that said ad doesn't annoy the hell out of iPad users by taking too long to load and being impossible to load.

</comment><comment><USER15> Yesterday, I fired one of my PHP developer. It is his 13th month. His team leader reported me that "He got average skills". Shame on me., Because, I hired him. After 13th month we fired him. Problem is really the hiring people (HR, CEO or anyone else). Now., I am preparing interview questions with twists & logic implementations.

<comment><USER10> _Average skills_? There was an article recently - I think by Joel on Software - that _everyone_ thinks they're hiring in the top 1%. I have to admit I'm kind of curious as to what you were looking for in your team when you hired the guy, I can't tell unless you elaborate more. In addition, I agree with danilocampos: the problem might be in your hiring process. I'm not sure that throwing out puzzles or whatever will help you reduce your number of false positives.

<comment><USER16> The article you are referring to was recently posted on HN, but published in 2005: <http://www.joelonsoftware.com/items/2005/01/27.html></comment></comment></comment>


Ask HN: Working in product company allocated techdebt or unittesting what to do? - <AUTHOR> I'm working in product based company and I see there are lots of open back logs items in bucket still I am assigned with technical debt and unit testing stories only. Seeking suggestions for what to do? <comment><USER2> How long have you been at this company?</comment>


Middle East stock exchanges hit by hackers - <AUTHOR> http://www.computerworlduk.com/news/security/3330924/tadawul-adx-stock-exchange-hit-by-hackers/

<comment><USER2> No, their _websites_ were _slowed_.

Not hacking, DDOSing.

Not the exchange itself, the marketing pages.</comment>


The US Marines tested all-male squads against mixed-gender ones - <AUTHOR> http://qz.com/499618/the-us-marines-tested-all-male-squads-against-mixed-gender-ones-and-the-men-came-out-ahead/ <comment><USER3> FTA: " _Of all the consistent patterns we can discern in war, there are two concepts of universal significance in generating combat power: speed and focus. ... speed is a weapon._ " [1] (quoting the Corps publication _Warfighting_ [2]).

FTA: " _Research from various U.S. and allied military studies reveal that the two primary factors associated with success in the task of movement under load are 1) lean body mass and 2) absolute VO2 Max._ " [1]

[1] [https://assets.documentcloud.org/documents/2394531/marine- co...](https://assets.documentcloud.org/documents/2394531/marine-corps-force- integration-plan-summary.pdf)

[2] [http://www.marines.mil/Portals/59/Publications/MCDP%201%20Wa...](http://www.marines.mil/Portals/59/Publications/MCDP%201%20Warfighting.pdf) (1997; couldn't find a more-recent one).

</comment><comment><USER4> When I joined the Army I weighed ~ 120lbs. Less than a year later I had completed basic training, advanced infantry training, jump school and the Ranger Indoctrination Program (programs completed in the order listed). After graduating RIP I served in special operations as an Airborne Ranger.

I'll never forget something that happened during my first training mission with the 75th Ranger Regt. After several hours of rafting and patrolling I was walking up a hill carrying a full load plus an M4. I was sucking hard, covered in sweat and my whole body was on fire. A tabbed E4 walks by me, not a drop of sweat on him, and up the hill like it's nothing. He looks over at me, as he's walking by, and says "you're carrying that and I'm carrying this." He was carrying a 240G (probably 5x the weight of my M4). I leave it up to you to form your own interpretation of his words.

~5 years in Regiment I weighed 170lbs and could run through everything I did my first deployment carrying twice the weight.

The importance of training is immeasurable.

</comment><comment><USER5> 2017 - This just in...so it turns out it may have been the men slowing down the integrated squads in that US Marine "evaluation" a few years back . Yesterday an _all-female_ squad dominated their traditional all-male counterparts in everything except for the wall climb. With the on-going shortage of tactically relevant walls to climb in Iraq, we may start to see more female only units leading the way.

</comment><comment><USER6> I wonder if this would reduce the incidence of rape and child abuse that occurs in warzones and peacekeeping missions.

<comment><USER7> Maybe. But probably the whole context and power dynamics is a lot more important (see [https://en.wikipedia.org/wiki/Lynndie_England](https://en.wikipedia.org/wiki/Lynndie_England)).

</comment></comment><comment><USER8> So the caveat about 50% in is huge enough as to render the exercise almost entirely pointless, and they could have easily controlled against it had there been any will to.

<comment><USER9> Here it is for those who can't be arsed to look for it (emphasis mine):

> many of of the male study participants had previously served in combat > units, whereas _female participants, by necessity, came directly from > infantry schools or from noncombat jobs_.

</comment></comment><comment><USER10> What about testing for soft-skills? Would an integrated-gender unit be better at pacifying an area because it was more able to communicate with the locals? A regular criticism of the US military by it's allies in Iraq was that it's soldiers so rarely got out of their fortresses and armed vehicles and actually pressed the flesh, an action that significantly helps with pacification.

<comment><USER11> Frankly, the US military isn't exactly known for its de-escalation or cultural sensitivity. My uncle served in a peacekeeping mission where they had the misfortune of coming in after the Americans, who had made it a habit to drive their tanks along the curbs so they'd be welcomed by rather disgruntled locals.

</comment></comment><comment><USER12> Sigh. Why didn't they use inexperienced soldiers of _both_ sexes in the experiment? I smell some junior officer figuring out a way to deliver the result that his senior officer really wanted to hear.

Now, to a certain extent, doubly inexperienced is also skewed because it would be quite removed from actual battlefield performance.

<comment><USER3> > _Why didn 't they use inexperienced soldiers of_ both _sexes in the > experiment?_

That likely would be flawed in its own right --- these days there are probably few infantry squads composed solely of combat virgins. The Corps summary suggests that the study might have tried to control for lack of combat experience: " _Male provisional infantry (those with no formal 03xx_ [i.e., infantry] _school training) had higher hit percentages than the 0311 (school trained) females: M4: 44% vs 28%, M27: 38% vs 25%, M16A4w /M203: 26% vs 15%._" [1]

[1] [https://assets.documentcloud.org/documents/2394531/marine- co...](https://assets.documentcloud.org/documents/2394531/marine-corps-force- integration-plan-summary.pdf), linked FTA

<comment><USER13> > That likely would be flawed in its own right --- these days there are > probably few infantry squads composed solely of combat virgins.

But since they weren't testing all-female squads, but integrated squads and all-male squads, this is easy to address: determine an appropriate and typical distribution of experience levels. For the all-male squads, use men of this distribution. For the integrated squads, do the same, only replace some-to-all of the combat-inexperienced _men_ from the typical experience distribution with combat inexperienced _women_.

Then you are getting a fair representation, without either skewing the _overall_ experience distribution so you have atypical squads on both sides, or skewing the experience distribution low on only the integrade side so you aren't comparing like against like.

</comment></comment></comment><comment><USER14> A great many people seems to be very upset that a large portion of the non- integrated squads had experienced Marines, as if this negates the test. Two things:

First, the integrated squads had experienced Marines as well. They selected randomly (within criteria) to have the MOS (Military Occupational Speciality) and experience distribution a typical combat unit would have. That means both junior and senior Marines. That also means that, as combat MOS's have not yet been integrated, women will by definition be inexperienced in combat roles. This does _not_ mean the women were inexperienced Marines.

Second: This is not an experiment about what's fair, it's to test what's real right now. And when women are integrated into combat roles en masse, this is what that will look like. Women will be less experienced and will be both integrated with, and adversary to, experienced male combatants.

This is a test of the _current_ situation--everyone is green once. But that changes. And women _will_ gain significant combat experience. You'll see an evolution in training to shore up potential weaknesses and exploit inherent strengths (and they are manifold) that women bring to the table.

That said. As it currently stands with women having had less experience, there is the very real potential that those units they are integrated into will experience a s degraded combat capability until training learns to compensate for certain inherent physical and psychological differences between the sexes (not to mention internal cultural hurdles that they inevitably be faced with). Degraded capability means an increased likelihood of casualties in combat. As I said, I believe this will change. I believe in five years this type of test will yield far, far closer results.

The question is this: Is that painful (and very likely lethal) initial period worth the ultimate goal of total integration? Is the risk to our servicemen and servicewomen worth that ultimate reward? I believe it is. I was pro-gender integration before I joined the US Army, I was pro-integration during my six years in the Service, and I remain fervently pro-integration years later as a significantly balder and fatter man.

It's worth it. But don't hide yourself away from the fact that there will be pain.

<comment><USER15> It seems the military in general does not believe the initial painful period would be worth the ultimate goal of total integration. The article quotes a government study from 1992:

A military unit at maximum combat effectiveness is a military unit least likely to suffer casualties. Winning in war is often only a matter of inches, and unnecessary distraction or any dilution of the combat effectiveness puts the mission and lives in jeopardy. Risking the lives of a military unit in combat to provide career opportunities or accommodate the personal desires or interests of an individual, or group of individuals, is more than bad military judgment. It is morally wrong.

This was 1992, when there didn't exist the taboo we have today of not speaking against gender integration and government and military leaders could speak their minds.

<comment><USER9> The military in general did not believe in open LGBT or racially integrated service either. I wouldn't put any stock in any opinion proffered by the military itself, their job is to toe their line and present a cohesive front supporting whatever is the current policy, and there's few the military in general likes less than changes in policy.

</comment></comment></comment><comment><USER16> Should we really be comparing the two genders at all? Is it possible to just set minimum standards - "must be able to run x km in y minutes", "must be able to get x% of rounds on target at y m" \- and then accept anyone who meets or exceeds those?

<comment><USER17> The study is not primarily comparing genders, it's comparing gender-integrated squads with all-male squads.

Accepting or denying people based on individual performance does not necessarily account for whatever psychological differences might be at play in those types of squads. For example, the article mentions that male marines tended to be the ones who fireman's-carried an "evacuee" in gender-integrated squads. Maybe the women are capable of doing it, but the men feel some psychological pressure to do it instead of them (e.g., chivalry), or the women expect the men to do it (e.g., chivalry), affecting the way the squad operates. The squad also mentions higher rates of injury among women marines.

That said, maybe there are some individual performance standards that cause these squad differences disappear. For example, perhaps both male and female marines who can run an 8 minute mile get injured less in training, but fewer women than men can run the 8 minute mile. Setting that as the time standard might eliminate the discrepancy at the squad level. The study appears to call out considerable performance differences however (1):

> The well documented comparative disadvantage in upper and lower-body > strength resulted in higher fatigue levels of most women, which contributed > to greater incidents of overuse injuries such as stress fractures.

> Anaerobic Power: Females possessed 15% less power than males; the female top > 25th percentile overlaps with the bottom 25th percentile for males. > Anaerobic Capacity: Females possessed 15% less capacity; the female top 10th > percentile overlaps with the bottom 50th percentile of males. Aerobic > Capacity (VO2Max): Females had 10% lower capacity; the female top 10th > percentile overlaps with bottom 50th percentile of males

> Within the research at the Infantry Training Battalion, females undergoing > that entry-level training were injured at more than six-times the rate of > their male counterparts. 27% of female injuries were attributed to the task > of movement under load, compared to 13% for their male counterparts, > carrying a similar load.

The military is right to study these things and try to do so objectively. And I don't see why it's wrong to compare genders or races - it sometimes leads to useful advances like studies of disease that affect certain parts of the population and not others (breast cancer, sarcoidosis, etc.) The point is that we're speculating and more data will lead to better decisions.

(1) [https://assets.documentcloud.org/documents/2394531/marine- co...](https://assets.documentcloud.org/documents/2394531/marine-corps-force- integration-plan-summary.pdf)

</comment></comment><comment><USER18> The actual headline was "The US Marines tested all-male squads against mixed- gender ones, and the results were pretty bleak".

> bleak

Bleak means roughly "not hopeful or encouraging". That highlights the author's bias pretty clearly. Nevermind that this research has the ability to save lives. The findings are bleak to the author because they contradict ideas of equality of outcome.

<comment><USER19> I think you're projecting. They were ordered to open all combat roles to women. If that results in problems, that could well be considered "bleak" irrespective of other concerns about equality.

Beyond the headline, the piece sticks narrowly to the facts. I don't think the author let any obvious bias through.

<comment><USER20> Is it not better to have the roles open but simply make sure that everyone that gets through meets a minimum standard?

</comment></comment></comment><comment><USER21> Sounds deeply flawed given that the men had previous experience and the women didn't.

<comment><USER22> That's definitely a flaw in the study. On the other hand, I doubt using equally experienced males would change the conclusions significantly: majority of the tasks seem to have involved major physical effort, and you don't need a study to know that on average, males will perform better in physically demanding excercies.

<comment><USER23> Weapon use seems to have been a big part, and is that really a "major physical effort"? Unless you fire the rifle at the end of an obstacle course...

<comment><USER24> Ever ran with a machine gun?

The fact the women seem to have done as well as men wrt hit probability using the M4 but not the heavier weapons, really point to physical limitations and not lack of skills.

The casualty evacuation issue is also a major issue, men can carry both sexes, women will have trouble with many men, and will be completely unable to move the bigger men...

</comment></comment></comment></comment><comment><USER25> Mark my words, some of the over the top diversity training is foreign intelligence, this is not a conspiracy theory. I grew up in an immigrant community but never ever met people who were as enthuasiatic as "diversity" or ultra integrationalist past the point of function as I hear about. One day I think we will find out that people were manipulating us at the points we were the most sensitive, that is our relationships to each other as human beings.

<comment><USER19> Are you saying that promotion of gender equality is a CIA plot? Can you elaborate a bit more about this "manipulation" you're talking about, and what it is supposed to accomplish?

<comment><USER26> Do you think "manipulation" and social engineering by our three-letter agencies is just a completely outlandish idea? These agencies have no problem overthrowing democratically elected governments in other countries (See Iran, 1953). They have no problem kidnapping people and feeding them LSD (See MK- Ultra).

Henry Makow explains one theory here - [http://www.henrymakow.com/001904.html](http://www.henrymakow.com/001904.html) \- (Basically, "The hidden goal of feminism is to destroy the family, which interferes with state brainwashing of the young. Side benefits include depopulation and widening the tax base. Displacing men in the role of providers also destabilizes the family.") Say what you want about Henry; the guy is no dummy. And if you still think that the CIA and "the powers that be" don't want to influence society at large, then go look up Operation Mockingbird.

<comment><USER19> I didn't offer any judgement at all. I just asked poster 'eruditely' to elaborate, as I don't really understand what he's trying to say.

I happen to find the notion that the CIA is responsible for the feminist movement rather implausible compared to alternative explanations, such as ordinary women being fed up at their lack of equal treatment or social status and genuinely wishing for social improvement. But again, that's not what my prior comment was about.

I've never heard of Henry Makow but based on this essay he seems like a crank.

> _The banking cartel needs a philosophy to justify enchaining mankind. That > philosophy is Satanism. The cartel controls the world through a network of > occult societies linked to Freemasonry, Communism, the Vatican and organized > Jewry (Bnai Brith, ADL, AJC, Zionism.) The highest occult rank is known as > the Illuminati._

Is this some kind of parody?

<comment><USER27> Crank is generous.

[http://rationalwiki.org/wiki/Henry_Makow](http://rationalwiki.org/wiki/Henry_Makow)

<comment><USER26> Yeah and RationalWiki is about as rational as the Catholic church - [http://lesswrong.com/lw/f5b/the_problem_with_rational_wiki/](http://lesswrong.com/lw/f5b/the_problem_with_rational_wiki/)

<comment><USER27> Your inability to point out any errors in the rational wiki page about Makow is noted.

<comment><USER26> And your inability to make an argument of any kind has also been duly noted.

Did you actually read the RatWiki page? It lists a bunch of cherry picked facts about his views along with some snarky commentary. Wow! Really powerful stuff there.

<comment><USER27> I did read the rational Wiki page. It shows Makow has a bunch of beliefs - <USER2> was a conspiracy; THE JEWS DID IT; etc - that are a strong signal that he isn't worth any more of my time.

Again, feel free to point out any particular errors.

<comment><USER26> And again - you haven't proven one thing wrong with Henry Makow by simply stating his views and saying that you don't like them. Sorry, but you don't win arguments by saying your opinion over and over. You can think so, but you'd be wrong...again.

So the answer is basically: Mu. I don't need to point out errors in RatWiki. I already pointed out your own error - that you're not bringing anything to the table here other than your poorly formulated opinion.</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


Government requests for user information double over three years - <AUTHOR> http://googleblog.blogspot.com/2013/11/government-requests-for-user.html

<comment><USER2> I can't believe I'm gonna write this, but in their defense, google user base had also likely doubled during that time.

<comment><USER3> A lot of the increase is from non US countries. Presumably they realized they _can_ request things, and are now starting to.

<comment><USER4> Appetite comes with eating.</comment></comment></comment>


Do you feel gRPC a good way to expose external APIs? - <AUTHOR> Read https://medium.com/@sankar.p/how-grpc-convinced-me-to-chose-it-over-rest-30408bf42794
I got the point that gRPC is a great choice building internal facing APIs (inter microservices); but I feel gRPC is overrated in the context of external facing APIs -- see the "Pain Points of gRPC" above, moreover, the perf benefits are much less a concern in the context of external APIs.
Can someone chime in and share their first hands experience? <comment><USER2> The first pain point in the article of no browser support is no longer true. There is now grpc-web [https://github.com/grpc/grpc- web/](https://github.com/grpc/grpc-web/)

<comment><AUTHOR> I think browser support is only one point (though it's a big one), but pattern how the clients consume a third party service remain unclear to me if gRPC brings in the right return.</comment></comment>


Inside The Fine Art Factories of China - <AUTHOR> https://instapainting.com/blog/company/2015/10/28/how-to-paint-10000-paintings/ <comment><USER2> I've visited Dafen several times, had conversations with artists there, and purchased some paintings. The quality ranges from gradeschool-esque to fine art, even if most of it isn't original. I have no problems with factory-style creation of art, either. If people don't buy it, they won't create it. The vast majority goes to commercial properties looking for semi-generic-but-in-a- specific-style-or-color-scheme art for their public spaces or private rooms, and although it's blatantly obvious how crappy a hotel room painting is, it still beats staring at blank walls.

These folks have found yet another way too bootstrap themselves out of poverty, and with startups like instapainting or [https://www.nobilified.com/](https://www.nobilified.com/), it's easier than ever for them to have a global reach. Good for them! Good for us!

<comment><USER3> Here is the problem: why can't we have these guys painting actual art?

A decade ago I was visiting the Dominican Republic and saw street vendors who sold touristy paintings that took them less than an hour to complete. Beach, sunset, palm. They weren't good but they were unique.

<comment><USER4> _" Here is the problem: why can't we have these guys painting actual art?"_

Ever created visual art? Most art you see is commercial art. Capital-A, Art is personal. To create an original piece of art takes a lot of effort, be it something visually inspiring, a novel concept or deeply felt emotion. Apply some technique and maybe you might come up with something good, maybe?

 _" En plein air"_ isn't always practical.

Think of a photographs used in the way you describe, as the _" Cheeze-Wiz"_ of inspiration for commercial art.

<comment><USER5> I don't know. Isn't that backwards? "If its easy, its not real" is too simple.

Art may be defined by the artists' effort, or by the effect is has. Plenty of folks are impressed/astounded by 'street art'. Why is it not real, just because the artist had the chops to make it look easy?

<comment><USER4> _" Isn't that backwards? "If its easy, its not real" is too simple."_

good point @Joe, what I'm trying to explain is, it's inspiration that's hard. The Muse. Art that comes easily, rarely looks/feels bad.

</comment></comment></comment></comment></comment><comment><USER6> This was a fascinating read. Surprised that painters have seemingly good working conditions, set their own hours, and work from home!

Just a random idea: when targeting mid-market customers, have you considered going "Watsi" style? Instead of an Instapainting storefront, what about commissioning artwork directly from painters? Display the painter's name, their photo, number of previous paintings painted, and their affordable price to commission a painting.

Effectively, you could become the Internet-version of those studios themselves.

<comment><USER7> I'd like to see an undercover investigation. This piece ended up being a little too close to propaganda.

<comment><USER8> Decent working conditions, flexible hours, desirable job, in China?! That's blasphemy!

Well, the desirable job part might be stretching it...more like shitty job in a highly respected profession.

<comment><AUTHOR> That's true, the artists that do the photo to painting aren't necessarily ecstatic about signing their names on it.

</comment></comment></comment></comment><comment><USER9> Seth Godin talks about Dafen in a bunch of his books. There is an entire section of the town that just makes monkey paintings. My favorite anecdote is about one of his monkey paintings that inexplicably has what looks like a teardrop on it. He said he was confused about this for a while, but then realized what must have happened -- some rain got on one of the paintings, and from then on everyone just kept copying the smudge. (Part of a larger riff about how not everyone who makes paintings or whatever is an artist.)

<comment><USER10> I'd be interested in reading this. Can you point me to a specific book?

<comment><USER9> He talks about this in his book Linchpin, but he talks about it in a bunch of other places as well:

[https://www.google.com/search?q=%22seth+godin%22+dafen&oq=%2...](https://www.google.com/search?q=%22seth+godin%22+dafen&oq=%22seth+godin%22+dafen&aqs=chrome..69i57.3625j0j4&sourceid=chrome&es_sm=119&ie=UTF-8)

</comment></comment></comment><comment><USER11> In college my friend told me about this gig selling art that I took him up on. We picked up a moving truck from a warehouse and drove it to a city about 20 hours away and set up art sales in hotels. When I asked the owner of the operation where the paintings were from he said Asia.

The paintings themselves appeared to be legitimate paintings. Most were different, but a few were very similar to other paintings packed into the truck. Often an object in the painting was moved slightly. Some even looked like classic paintings, I found one or two variations of Van Gogh's Starry Night, as mentioned in OP's article.

Each one of these paintings sold for about $40-$100, depending on size.

I made decent money for a college kid but I declined a second gig as I was concerned about where these paintings were coming from. I pictured a sweatshop like scenario with painters inhaling fumes while getting paid pennies for each painting. It's good to hear that probably isn't the case, at least according to this article. The paintings were also marketed as being painted by "starving artists" and the whole operation felt a little dishonest.

</comment><comment><USER12> The only thing that Instapainting and similar businesses demonstrates is that bad photos don't make good paintings, especially when they're paint-by-numbers copies of bad photos. IMHO most of Instapainting's customers would be better off applying a "painterly" filter in Photoshop to their photos and have them printed to canvas at their nearest Costco.

Paintings of photos look like paintings of photos because they're crippled by the artefacts of the source photo such as unnatural perspective (which is why the "normal" 50mm lens is a thing), inaccurate colours and clipped highlights due to the limited dynamic range of even pro-level DSLRs.

Professional painters take years to hone their craft and learn the rules of composition that make a painting look good. E.g., one of my favourite painters is the watercolour virtuoso Joseph Zbukvic. Here's a video where he quickly paints an impressionistic Melbourne street scene: [https://www.youtube.com/watch?v=81w9PBZOmZ8](https://www.youtube.com/watch?v=81w9PBZOmZ8). Because he's not slavishly copying the photo he's free to rearrange the composition and add elements to make it more pleasing. He makes it look easy but that's because he's one of the best.

Buying original paintings from professional artists doesn't have to be that expensive. This past weekend I attended a group art show opening in Melbourne and prices ranged from $450 to $2200 for some very nice original oil & watercolour paintings. If you can afford to live in the Bay area or most other large cities in the developed world, you can afford to occasionally pay that much for a painting.

(Most of the stuff churned out by the "contemporary art" scene can be safely ignored. At the very high end contemporary art isn't art as much as it is an unregulated private currency for the very rich to launder and move around their wealth. Most contemporary art disappears without a trace.)

<comment><USER13> _" IMHO most of Instapainting's customers would be better off applying a "painterly" filter in Photoshop to their photos and have them printed to canvas at their nearest Costco."_

That works quite well, especially if you use one of the better inkjet printers with six or seven inks, print on canvas, and finish off with a sprayed clear coat. This is called "Giclée".[1]

There's already an online service for this.[2] You can even see what the result will look like before you order. Price is about $30-$50/square foot.

[1] [https://en.wikipedia.org/wiki/Giclée](https://en.wikipedia.org/wiki/Giclée) [2] [http://www.canvaspress.com/](http://www.canvaspress.com/)

<comment><AUTHOR> Yea, we offer high quality archival canvas prints printed on demand through our sister site: [http://www.amanufactory.com](http://www.amanufactory.com)

There isn't just _an online service_ for this, there are literally thousands.

</comment></comment></comment><comment><USER14> Chris: I've seen at least half a dozen of these businesses come and go. None of them seem to be able to scale enough to make for an exciting long-term business worth reinvesting in. Despite individuals absolutely loving the final product. Any thoughts on why this is, and how you can succeed where others have failed?

<comment><AUTHOR> We're completely bootstrapped, so we don't have unrealistic investor expectations or valuation targets to achieve or else implode. I think that's probably the primary reason most of these businesses disappear.

They either invest a lot of money themselves or raise money from investors with the hope of making it back in profits that don't come (for whatever reason).

I started Instapainting with a negative bank balance, so everything we've done has been optimized to increase revenue and efficiency.

<comment><USER15> Why does your blog post say you're backed by YC if you're bootstrapped?

<comment><AUTHOR> We ran out of YC (and other investor's money), and pivoted to this to make money.

</comment></comment></comment></comment><comment><USER16> > And it likely played well with Western executives, who preferred to hear > that their product was being mass produced in factories rather than > subcontracted to rural artists.

Absolutely fascinating! That's quite an interesting discussion point.

</comment><comment><USER17> I'm somewhat surprised no one has of yet written an algo that can do this sort of thing on demand.

Would it even matter it was automated if it did a good job? Are these artists is Dafen nothing but automatons, waiting to be replaced by some AI and a modded 3d plotter?

Personally, I would not care how it was produced if I wanted such a painting.

<comment><AUTHOR> We have been trying:

[https://www.instapainting.com/ai-painter](https://www.instapainting.com/ai- painter)

[https://www.instapainting.com/blog/research/2015/09/10/robot...](https://www.instapainting.com/blog/research/2015/09/10/robotic- painter-color/)

[https://www.instapainting.com/blog/research/2015/08/23/ai- pa...](https://www.instapainting.com/blog/research/2015/08/23/ai-painter/)

Now the trick is to bridge the gap between the neural net algorithm and the physical robot.

Unfortunately this photo to line drawing is the best we can do so far: [https://twitter.com/instapainting/status/636245176554405892](https://twitter.com/instapainting/status/636245176554405892)

</comment></comment><comment><USER18> I have a knockoff (or a 'copy', as some like to say) Yue Minjun piece from one of these places. Aside from a couple minor flaws, it's actually fairly high quality. Having it framed was about 13x more expensive than the painting itself.

<comment><AUTHOR> The economics of framing are tricky too. Frames are actually just as cheap in China FOB price, especially if they are a mass-produced size. Even if not mass-produced, a frame from China would be priced in line with a custom painting.

The issue is that shipping prices are by weight, and the frames are usually much more heavy than a piece of canvas. This significantly drives up the total price of a frame from China, and lets American framing companies charge much higher prices.

Pro tip: get the artwork in a size that already fits a standard frame size and you'll save a ton of money.

<comment><USER18> >The issue is that shipping prices are by weight, and the frames are usually much more heavy than a piece of canvas

Which is precisely why I brought the canvas home in a tube.

>Pro tip: get the artwork in a size that already fits a standard frame size and you'll save a ton of money.

Eh. I looked at such options, but wasn't impressed. Ended up settling on a fairly oddball, incandescently red glossy frame. Goes well alongside the subjects (a bunch of PLA guys).

</comment></comment></comment><comment><USER19> Been a few times. Very cool place with tons of artwork. The originals are hard to find but even the replications and copies are fascinating and watching people do it is very interesting.

</comment><comment><USER20> Exploitation?

</comment><comment><USER21> And now I know why so many fine artists can't find work unless it is purely original work (a highly volatile market). I am saddened deeply that even art has degraded to this. if you want a print, buy a print from a printing machine. You want an oil painting? Hire or barter with a local artist to do so. I can't even. I just can't even.

<comment><USER22> Aside from respecting geopolitical borders and nationalistic allegiance, why should I value a local artist any more than an artist in China? Is the Chinese artist somehow lesser than the local artist?

<comment><USER21> is synthetic vanilla `less than` real vanilla? People are not the problem here, the product is. It lacks in the POINT of art.

Art is like going to a concert, an expression of the human condition. Why go if you can listen to a perfect mix of it at home?

How you get a painting is part of the reason you get the painting at all. The story behind it is just as much of the point as the piece itself.

To be clear: If you are in China, buy art from a Chinese artist. If you are in Brazil, buy art from a Brazilian artist.

<comment><USER23> I think the downvotes are coming from the following interpretation of your comment: No true Artsman buys art internationally.

<comment><USER21> likely. but that wasn't my intent.</comment></comment></comment></comment></comment>


That 'Useless' Liberal Arts Degree Has Become Tech's Hottest Ticket - <AUTHOR> http://www.forbes.com/sites/georgeanders/2015/07/29/liberal-arts-degree-tech/ <comment> anti-shill paid propaganda from the liberals arts professors' lobby?

<comment><AUTHOR> Yes, their clever plot to have Stewart Butterfield masquerade as the CEO of a Silly Valley "unicorn" is proceeding according to plan.</comment></comment>


Ryan Petersen: Paul Graham just donated $1M for PPE for healthcare workers - <AUTHOR> https://twitter.com/typesfast/status/1241036939907624961 <comment><USER2> Paul Graham ( @paulg ) just donated $1,000,000 to [http://Flexport.org](http://Flexport.org). That gift will pay for almost all the protective gear required by the entire city of San Francisco's frontline healthcare workers. We'll likely distribute the equipment to hospitals in other locations too.</comment>


Mini review of tog: the new OpenBSD git browser - <AUTHOR> http://akpoff.com/archive/2019/mini_review_of_tog.html <comment><USER2> I wanted to try it out just for 5 minutes, but alas, I'm on Arch Linux and can't compile. GNU Make complains about dots in the Makefile (things like .include and .if) and there are probably more issues like BSD specific .include <bsd.subdir.mk>.

It's the early days for the tool but hopefully it will become available on Linux in the future. Because the world totally needs yet another git wrapper and visualisation tool. I jest of course, but there are already a few tools I wanted to learn but never dedicated the time for. For example _hub_ command line utility for working with github. _git-extras_ for lots of small things like repository statistics. _fugitive.vim_ , a vim plugin that claims to be a git wrapper so awesome it should be illegal.

Recently I had to find out why a section of code was written a certain way and decided to hunt for the commit that introduced it. The only way to do it that I'm currently familiar with is by using github blame interface. The code was moved around so regular blame showed the commit that moved the code instead of introduced it. Github allows you to jump to a commit before the change, so I did that a couple of times while looking at the diff of where the code was removed from, because this was the place I actually needed. Overall I felt rather clumsy doing that and wondered if learning to do it on command line would be easier in the future. How can tog help here? Avoiding learning to use git on command line by itself isn't a good idea in any case, but a proper browser that allows to easily dive through history without shell trickery or a dozen of HTTP requests is a welcome addition.

Also, for tools like this I think video demonstration is best.

</comment><comment><AUTHOR> Would appreciate it if mod didn't change the title on this, because as of presently, nobody has any idea what "tog" is.</comment>


How to ask startup people for introductions - <AUTHOR> http://alexdschiff.com/post/48861396303/how-to-ask-startup-people-for-introductions

<comment><USER2> I wish more people understood how to ask for an introduction with grace. Too often it feels like there's no option to say no.

<comment><AUTHOR> This is a format that was beaten into me when I got started - most people default to really inefficient habits.

</comment></comment><comment><USER3> Great post man, totally agree. People are busy you got to make it easy for them to help you.

<comment><AUTHOR> Thanks!

</comment></comment><comment><USER4> If the person you want to get intro-ed to is too busy to currently help you out, is it typically OK to follow up again just a month later? Or would you recommend trying to get intro-ed by someone else?

<comment><AUTHOR> I'm assuming this is after the intro is made - no need to get a second intro unless it's after a really long period of time and you have a better connection. It's okay to follow up if you have a good pretense.

<comment><USER4> ok thanks Alex!</comment></comment></comment>


Will Pluto Be the Last Habitable World? - <AUTHOR> https://blogs.scientificamerican.com/life-unbounded/will-pluto-be-the-last-habitable-world/ <comment><USER2> No, see Eris, Sedna, Makemake, Haumea and numerous other worlds further out in the Kuiper belt

</comment><comment><USER3> Pluto might be a desirable spot for habitation in the next 100 years. It certainly doesn't lack in volatiles: the earth looks positively dry in comparison.</comment>


Robots could wipe out 1.3M Wall Street jobs in the next 10 years - ml-engineer https://www.businessinsider.com/banking-jobs-remain-popular-despite-the-threat-of-automation-2019-4 <comment><AUTHOR> Could be the same said about crypto?</comment>


Ask HN: flirt140, how are they determining the gender? - <AUTHOR>

http://www.techcrunch.com/2009/05/12/fked-company-and-adbrite-founder-launches-twitter-dating-site-flirt140/
flirt140 - Yet another twitter app :-(
one line caught the attention though
"Kaplan says a proprietary algorithm is used to determine gender of Twitter users and claims that it's pretty accurate"
Any idea how they are determining the gender? <comment><USER2> I don't know about Twitter, but determining gender ( _on average_ ) from English language text is pretty much a solved problem in natural language processing.

<http://www.hackerfactor.com/GenderGuesser.html>

See this paper:

[http://u.cs.biu.ac.il/~koppel/papers/male-female-text- final....](http://u.cs.biu.ac.il/~koppel/papers/male-female-text-final.pdf)

Sidenote: this was an epic win for me in Gender Studies class, when I said that not only was the professor's claim that the genders communicate "essentially identically but with some individual variation" wrong, but I would constructively demonstrate it by blind-assigning a stack of any papers she cared to give me. (I also gave her a copy of the above paper, which she read with interest.) The class then retreated from the scary notion of binary decisions on the basis of the scientific method to the more comfortable one of endless arguing whether the differences were socially constructed or biological.

<comment><USER3> There's a similar service at genderanalyzer.com, based on UClassify's API - <http://blog.uclassify.com/gender-text-analysis/>.

It thinks Sergey Brin writes like a woman: <http://www.genderanalyzer.com/?url=too.blogspot.com>

<comment><USER4> Maybe that ad for 23andme was actually written by Sergey's wife.

</comment></comment></comment><comment><USER5> want to know the secret? you're going to love it.

when you login, you have to run a search. it asks whether you're a guy/girl looking for a guy/girl. i'm guessing they might just save that first parameter, no?

that said, that natural language processing link is really sweet.

</comment><comment><USER6> Ugh I logged in through OAuth and it automatically made me follow their Twitter account. There should have more fine-grained control over what applications can do without asking/telling me.

<comment><USER7> What was their twitter account name?

<comment><USER6> flirt140

</comment></comment></comment><comment><USER7> My first step would be with first names. Michael = Boy and Amy = Girl. You'd be able to cover most of the users like this.

Look for He/She in messages directed @User.

<comment><AUTHOR> yes, I thought about it. but how many names can you save/check like that? won't it be a tedious process? Also, what about names from Europe, muslim names etc?

<comment><USER7> You build a database and program to match the names to a list. The database would contain only a few thousand records which would be easy to manage and speedy. Very simple process for a programmer. None of this work should be done manually.

For names you don't know you keep using other means to dig further. But no matter what tools I would use, matching names to gender would be highest weighted procedure and the first thing I'd try. Of course, there would have to be second and third things to try too.

Remember, these guys didn't say they were 100%. Who even knows what their definition of "pretty accurate" is.

</comment></comment></comment><comment><USER8> Perhaps they're using something like this method of guessing gender based on browsing history:

[http://www.mikeonads.com/2008/07/13/using-your-browser- url-h...](http://www.mikeonads.com/2008/07/13/using-your-browser-url-history- estimate-gender/)

</comment><comment><USER9> they are probably doing simple stuff like checking the type of words they used. Like if twit has "xoxoxo" then its a female or they check the user's friends and look for references to the user in their twits. i.e. "vijayr posted that [he] created a new thread on hackernews"

<comment><AUTHOR> hmm. that much isn't difficult to do - I checked out the site, didn't find a single mistake in 7-8 attempts of searching. Does this mean, that they also determine businesses/organizations and drop them from their list?

</comment></comment><comment><USER7> Why does "yet another twitter app" make you :(

<comment><AUTHOR> nothing against twitter, just that there is too much twitter news these days. it is a great, fun and useful service, but not exactly world changing</comment></comment>


Large-scale GWAS reveals insights into same-sex sexual behavior - <AUTHOR> https://science.sciencemag.org/content/365/6456/eaat7693 <comment><AUTHOR> If you have a WSJ subscription, this article provides a good overview:

[https://www.wsj.com/articles/research-finds-genetic-links- to...](https://www.wsj.com/articles/research-finds-genetic-links-to-same-sex- behavior-11567101661)

 _The study involved people who self-reported whether they had ever had sex with someone of the same sex, not whether they considered themselves gay, lesbian, bisexual or another orientation.

"Behavior versus identity are different components and different pieces of how people think about their sexual behavior," said Benjamin Neale, a geneticist and member of the Broad Institute of MIT and Harvard University who is one of the study's senior authors. "That is a really critical aspect to sort of appreciating and understanding how we think about these kind of issues."

Taking into account the entire contribution of genetic markers that may play a role, the researchers estimated that genetic variation could account for up to 8% to 25% of same-sex sexual behavior in the population studied. But when the researchers pooled all of the identified markers to create a score for an individual person, the genetic variation explained less than 1%, making it practically impossible to predict a person's sexual orientation or behavior based on their genome.

"It does solidify the fact that genes matter," said Michael Bailey, a psychology professor at Northwestern University who wasn't involved in the work. "But it also provides more support for something that we all knew, pretty much—that genes can't be close to the entire story."_</comment>