Haskell Researchers Announce Discovery of Industry Programmer Who Gives a Shit - <AUTHOR> http://steve-yegge.blogspot.com/2010/12/haskell-researchers-announce-discovery.html <comment><USER2> 140 points? Really?

I know it's fashionable in these parts to make fun of Haskell, but it's just not _funny_ unless the writer knows something about the language. Would you upvote these articles?

* Why C++ is More Object-Oriented Than Smalltalk

* Stupid Ivory-Tower Academics Claim "Perl Is Too Slow for Weather Simulation"

* LISP: It Would Be a Lot More Useful Without All the Parentheses

It's especially galling considering pg's various articles on language expressiveness; remember this quote, folks?

"""As long as our hypothetical Blub programmer is looking down the power continuum, he knows he's looking down. Languages less powerful than Blub are obviously less powerful, because they're missing some feature he's used to. But when our hypothetical Blub programmer looks in the other direction, up the power continuum, he doesn't realize he's looking up. What he sees are merely weird languages. He probably considers them about equivalent in power to Blub, but with all this other hairy stuff thrown in as well. Blub is good enough for him, because he thinks in Blub."""

When somebody tosses around phrases like _how to subvert Haskell's type system to accomplish basic shit you can do in other languages_ , it's a big red flag that they've never used Haskell, and possibly have never even seen Haskell code.

<comment><USER3> I think it's great that you've tried to provide a review criticizing this post. But please resist the urge to tell me what I ought to find funny, just as I have resisted the urge to tell you what you ought to find interesting.

Especially resist the urge to criticize others for liking things you find unworthy. Your comment's criticism of the OP is appreciated. Your comment's criticism of other members for voting for the post is, well, something else entirely.

<comment><USER2> Surely there are better places to post funny but thought-free links than Hacker News?

<comment><USER3> Privately, I agree with you and I haven't upvoted it. After that, I suggest that our options are to (1) Flag it if it's really off topic, and/or (2) Criticize it, which I think you've done well. My only concern is whether we should (3) be galled or outraged that others have their own idea of what ought to be #1 on HN.

I like humour, and it seems like we share a personal preference for the kind that makes you laugh and then think hard when you realize that there's something incredibly insightful at the heart of the joke.

Alas, I'm not skilled enough to pull that off myself. All I can say about Haskell is to quote Alan Perlis: _A language that does not change the way you think about programming is not worth learning_. And given that, the sad observation that most "Industry Types" as stereotyped in the OP are not interested in changing the way they think about anything.

It's more than a Blub thing, it's a comfort zone thing.

<comment><USER4> I think comfort zone plays a part in IT developers seeming uninterested in "new" ideas. Closer to the heart of the problem IMO is that most business applications are just not very interesting. You can reduce them to: take input values from screen, run SQL query, and post query results back to the screen. Writing good SQL is the most challenging part.

In order for apps to be more interesting - making new ideas in IT appealing - businesses must be willing to re-examine their processes and change them with an eye towards better automation and some business intelligence. However, getting a single department in a business to change its processes is as monumental as changing global warming.

Of course, another issue altogether is COTS reducing the applications actually written in-house. Making intellectual investments in powerful programming languages is just not sound when a developer is simply writing "glue" code between vendor systems.

People do generally get jazzed up in IT departments when new technologies come around. Sure, there are technological curmudgeons, but very few. Enthusiasm gets dampened when it is clear that a good business case cannot be made for the new technology.

(I used "new" relative to an IT department's current environment and not in reference to age of the technology.)

</comment></comment></comment></comment></comment><comment><USER5> "Avoid success at all costs."

 _I mentioned this at a talk I gave about Haskell a few years back and it's become quite widely quoted. When a language becomes too well known, or too widely used and too successful suddenly you can't change anything anymore. You get caught and spend ages talking about things that have nothing to do with the research side of things. Success is great, but it comes at a price._ \-- Simon Peyton Jones

</comment><comment><USER6> "We crafted a fake satirical post lampooning Haskell as an unusable, overly complex turd -- a writing task that was emotionally difficult but conceptually trivial." - This is pure gold.

<comment><USER7> On the "truth is stranger than fiction" front, I got a good chuckle from the monads-in-Perl link <http://www.perlmonks.org/?node_id=620692>:

"Anyway, I think it would be worth doing, if it could be expressed readably, but I was not able to figure out a way to do that."

There is some deep irony in monads in Perl not being readable enough for _Perl._

<comment><USER8> Actually, the "modern Perl" people are promoting a Perl style where your program contains more letters than special characters. They seem quite influential.

</comment></comment></comment><comment><USER9> If you don't find this funny, then you really need to examine your sense of humour, because this is not about making fun of haskell. It's barely about haskell at all. It is fantastically well constructed exercise in comic writing.

Stop thinking about the programming language wars for one minute and reread the text again, and look at the multileveled semantic games the author is playing. I thought most here were good at that?

Doug Hofstadter would be proud.

</comment><comment><USER10> I chuckled, and I'm happy Steve Yegge might blog some more, but this feels a bit like shooting fish in a barrel.

<comment><USER11> If only because you could fit all of the Haskell programmers into a barrel of standard size? I think that's the point of the article, actually.

<comment><USER10> More because it's easy to poke fun at Haskell in this way, even the Haskell people know they come off as obtuse and academic. AFAIK there's been much soul-searching in their community about how to get past that.

While Steve Yegge is a good satirist, I see this post as an extended version of this joke from the "Mostly Wrong History of Programming Languages":

 _Haskell gets some resistance due to the complexity of using monads to control side effects. Wadler tries to appease critics by explaining that "a monad is a monoid in the category of endofunctors, what's the problem?"_

<comment><USER12> I love that joke, because I barely understand it, but minimal understanding just makes it funnier.

</comment></comment></comment></comment><comment><USER13> If Douglas Adams were to write about programming this is how he would do it.

That's a compliment.

<comment><USER14> Or the Onion. Not as much of a compliment...

<comment><USER15> I agree that this seems to be exactly in the style of an Onion article; however, I think The Onion has put out some hilarious stuff. For example:

[http://www.theonion.com/articles/fuck-everything-were- doing-...](http://www.theonion.com/articles/fuck-everything-were-doing-five- blades,11056/)

</comment></comment></comment><comment><USER16> "I believe the root cause of the popularity problem is Haskell's lack of reasonable support for mutually recursive generic container types." \-- Super funny!

<comment><USER6> "If we can create a monadic composition-functor wrapper that is perceived as sufficiently sexy by hardened industry veterans, then I think we will see an uptick in giving a shit, possibly as much as a full extra person."

</comment></comment><comment><USER14> She explained the trap they set for Briars: "We crafted a fake satirical post lampooning Haskell as an unusable, overly complex turd -- a writing task that was emotionally difficult but conceptually trivial. Then we laced the post with deeper social subtext decrying the endemic superficiality and laziness of global industry programming culture, to make ourselves feel better. Finally, each of us upvoted the post, which was unexpectedly contentious because nobody could agree on what the [HN] voting arrows actually mean."

Apparently their approach was more successful than they thought.

</comment><comment><USER17> GHC Haskell actually supports mutually recursive generic container types, but you must enable type class system extensions which make type checking undecidable.

</comment><comment><USER18> This successfully trolled me, because I think Haskell is really good stuff made by really smart and cool people. Surely there was a better target for satire.

I'm an industry programmer (in C). I also have a bunch of packages on Hackage.

<comment><USER19> Are you sure it's not making fun of the people who _don't_ use Haskell?

</comment></comment><comment><USER20> Will there every be a satirical Steve Yegge post on HN that spawns any discussion other than quotes from the article itself?

<comment><USER21> That's what makes Yegge posts so long, I think: he thinks of everything people could say in response to his original "core" post, and then includes it in the post itself.

</comment></comment><comment><USER22> "Finding a person who gives a shit about Haskell is an inherently NP-complete computer science problem. It's similar in scope and complexity to the problem of trying to find a tenured academic who didn't have the bulk of his or her work done by uncredited graduate students."

<comment><USER23> Surely you could implement this search in at least O(n) time?

<comment><USER24> At least is easy. At most is hard.

<comment><USER25> "At least, if not better." The context disambiguates the direction of magnitude.

</comment></comment></comment></comment><comment><USER26> Facebook uses haskell.

<https://www.facebook.com/careers/puzzles.php> (They only accept answers in languages they actually use.)

</comment><comment><USER27> This was actually a personally test disguised as a blog post. See how you scored:

If you didn't understand it: You're not a hacker and never will be; go get your MBA.

If it upset you: You are a hacker without a sense of humor. You belong in a room without other people. Fed Ex will deliver your circuit boards tomorrow.

If you laughed once: You are an aspiring junior programmer. Keep on working hard and best wishes to you.

If you laughed more than once: You are a seasoned hacker. Nice to see you here.

If you sprayed Mountain Dew on your keyboard: You have that rare combination of understanding both bits and people. You must do great work.

If you are cutting and pasting these gems for your bulletin board: You and I must be kindred spirits. Email me. Let's do a start-up together.

<comment><USER28> If you write a post attempting to categorize everyone's sociability and competence based on how close their reactions are to yours: You are edw519

</comment></comment><comment><USER29> Loved the article, but someone please explain "faster than a teabagger with a grade-school arithmetic book". I'm pretty sure I got all the others.

<comment><USER7> _...their Giving a Shit gene shuts down faster than a teabagger with a grade- school arithmetic book._

[http://en.wikipedia.org/wiki/Tea_Party_movement#Use_of_term_...](http://en.wikipedia.org/wiki/Tea_Party_movement#Use_of_term_.22teabagger.22)

The implication is that TEA party constituents have no interest in actually understanding the grade-school math necessary to understand a budget.

<comment><USER29> Thank you very much (Canuck here so I don't usually get the political references).

</comment></comment></comment><comment><USER30> Honestly I think this is my personal funniest post of 2010. And no, it's not making fun of Haskell.

</comment><comment><USER31> my new favorite Yegge post. very funny. and so true. :)

</comment><comment><USER32> Sniff sniff. Whats that smell? O right, Onion worthy.

</comment><comment><USER33> <Insert Dons and the usual angry Haskell fanboy diatribes here> </satire>

<comment><USER34> Diatribes?

<comment><USER33> Stop pretending Dons. It is quite amusing that you are voted up 5 times for such a content-less comment yet you and your associates are powerless to downvote the article.

<comment><USER34> I'll have my associates look into this matter.

<comment><USER35> there is no cabal</comment></comment></comment></comment></comment>


Doorbell sends message to Cell Phone (2012) - <AUTHOR> http://hackedgadgets.com/2012/05/08/doorbell-sends-message-to-cell-phone/

<comment><USER2> Actual Make article: [http://makezine.com/projects/notifying-doorbell-with- pushing...](http://makezine.com/projects/notifying-doorbell-with-pushingbox/)</comment>


Ask HN: An HN for biology/medicine/biotech? Would you want one? - <AUTHOR>

Does such a site exist? Would you be interested in one?<p>Edit: If any of you want to help, email me at email@example.com, if you wish. <comment><USER2> There were a number of sites that were launched shortly after arc came out based on the news.arc code. The arc language and code are under the Artistic License 2.0 [1]. (I admit that I thought they were public domain) See arclanguage.org for more on news.arc and arc the language.

Here are the news.arc sites that I remember:

[newmogul.com] - by nickb was HN for business. I always assumed it was news.arc. Maybe not. Still worth reading up on. There were a number of HNers that used it regularly and were looking for another similar site when it went down.

[pageonetimes.com] - it was HN applied to sports.

[ballerinc.com] - I don't remember what that site specialized in.

All of these were based on the news.arc code. I don't think any of these are still around. But the news.arc code has continued to improve and become more stable so it may be viable option. So if you wanted to set up something for biology or medicine you could use the HN code and just customize it as you see fit. (Oh and put it behind apache, nginx, etc please, I can help just email me or ask over at arclanguage.org)

Good luck. I agree that if you can build the community and figure out how to get rid of bad data - it's a great idea.

[1] <http://en.wikipedia.org/wiki/Arc_(programming_language)> [2] <http://arclanguage.org/item?id=7564>

EDIT: Formatting ~ Sometimes I wish HN had markdown or textile...

<comment><USER3> I've been trying to pick up some of the newmogul.com community with <http://newsley.com>. It's my startup. It's not built using arc.news, however, I rolled my own using Django. And, while it's not up to arc.news functionality yet, it should be there pretty soon, and I plan on adding a bunch of new features in the coming months.

There's also <http://markenomics.com> that I believe is using arc.news for an economics/financial news site. The community isn't quite as active as it was a few months ago, however.

</comment></comment><comment><USER4> Count me in if you make it. Happy to help moderate too - contact details in my profile.

</comment><comment><USER5> I want that and a stackoverflow for the same. Thanks!

<comment><USER6> A stackoverflow for medicine could have enormous benefits, but considering how much "blind leading the blind" goes on there I'd be terrified if this is applied to a field with immediate consequences to people's well-being.

<comment><AUTHOR> Yeah, that's definitely the risk, but I'd imagine community feedback + academic/clinical education/training would somewhat mitigate that, although not fully. A good verification system would help too (for physicians), but then it'd feel more like an invite-only community, which could be good or bad - I'm not sure.

<comment><USER7> How about you can sort answers by total vote count OR only by verified account votes?

</comment></comment></comment></comment><comment><USER8> Graduate student neuroengineer here. Very yes.

</comment><comment><USER9> I'd love to see a website like this, especially if there's bioinformatics and computational biology there.

</comment><comment><USER10> As a student of bioinformatics, I would be interested in this.

Perhaps it could be a more fitting venue for those in the DIYBio scene.[1]

[1] <http://groups.google.com/group/diybio/topics>

</comment><comment><USER11> If you want to get something up quick, you could use <http://slinkset.com> (aquired by Posterous in June 2009). It lets you create a social news site in seconds.

</comment><comment><USER12> Sounds like a great idea - I'd be happy to help out too if you need it.

</comment><comment><USER13> I would love this. Many times there are articles that would be more appropriate for that kind of forum, but I post them here to catch the hacker/biotech crossover crowd.

</comment><comment><USER14> Graduate student biophysicist, I'd be interested.

</comment><comment><USER3> I'd be interested. I have a background in healthcare, so stuff in bioinformatics/biotech/medicine would be of interest to me.

</comment><comment><USER15> Though it's not one of my major interest I'd look like to hang around. But I got few friends who are well interested.

Kudos

</comment><comment><USER16> As a bioinformatics/molec bio student, I would be interested in a bio HN.

</comment><comment><USER17> Would be cool to see, not sure how accessible it would be to me though.

</comment><comment><USER18> I'm a student of bioinformatics and I support this idea. Count me in.

</comment><comment><USER19> would definitely be interested and would be interested to help out.

</comment><comment><USER20> That sounds terrific. I'll send an email later.

</comment><comment><USER21> Great idea if executed on the same level as HN.

</comment><comment><USER22> sounds like it would work better in the midwest, where are you going to host it?

</comment><comment><USER23> definitely a great idea</comment>


Overpopulation Is a Myth - <AUTHOR> https://overpopulationisamyth.com/ <comment><USER2> Things that aren't sustainable don't continue.

I believe we should do nothing and let Old Ma Nature do the required culling. And she will.

All of humanity's problems including Climate Change, loss of water resources, loss of food resources, destruction of ecological systems, etc, etc, etc ultimately come down to humanity's lack of control of overpopulation.

</comment><comment><USER3> Found it to be very superficial and "read the science" button provides very limited information.

Can anyone recommend a better resource on the subject?

<comment><USER4> Catton, _Overshoot_ : [https://www.worldcat.org/title/overshoot/oclc/16587666&refer...](https://www.worldcat.org/title/overshoot/oclc/16587666&referer=brief_results)

Meadows et al, _Limits to Growth_ : [https://www.worldcat.org/title/limits-to- growth/oclc/8165904...](https://www.worldcat.org/title/limits-to- growth/oclc/816590435&referer=brief_results)

Online: [http://www.donellameadows.org/wp-content/userfiles/Limits- to...](http://www.donellameadows.org/wp-content/userfiles/Limits-to-Growth- digital-scan-version.pdf)

30 year update: [https://www.worldcat.org/title/limits-to-growth- the-30-year-...](https://www.worldcat.org/title/limits-to-growth-the-30-year- update/oclc/780854826?referer=br&ht=edition)

Joel E. Cohen, Carrying Capacity:

Article: [https://www.worldcat.org/title/population-economics- environm...](https://www.worldcat.org/title/population-economics-environment- and-culture-an-introduction-to-human-carrying- capacity/oclc/7025335639&referer=brief_results)

Book: _How many people can the earth support?_ [https://www.worldcat.org/title/how-many-people-can-the- earth...](https://www.worldcat.org/title/how-many-people-can-the-earth- support/oclc/898942239&referer=brief_results)

Ophuls, _Ecology and the Politics of Scarcity_ : [https://www.worldcat.org/title/ecology-and-the-politics- of-s...](https://www.worldcat.org/title/ecology-and-the-politics-of-scarcity- revisited-the-unraveling-of-the-american- dream/oclc/872523631&referer=brief_results)

Ophul's bibliographies are excellent, one online: [https://old.reddit.com/r/dredmorbius/comments/6fgq8g/william...](https://old.reddit.com/r/dredmorbius/comments/6fgq8g/william_ophuls_bibliographic_note_sources_on/)

Smil, _Energy and Civilization_ : [https://www.worldcat.org/title/energy-and- civilization-a-his...](https://www.worldcat.org/title/energy-and-civilization- a-history/oclc/1029804020&referer=brief_results)

Weissenbacher, _Sources of Power_ (2 vols): [https://www.worldcat.org/title/sources-of-power-how- energy-f...](https://www.worldcat.org/title/sources-of-power-how-energy- forges-human-history/oclc/416715097&referer=brief_results)

<comment><USER3> Thanks!

<comment><USER4> My pleasure.

The set tends toward the pessimistic side, but I find that more credible.

Ophul's earlier bibliography ( _Ecology & the Politics of Scarcity_) includes numerous works on both sides of the limits question, including Khan and Simon, John Maddox ( _The Doomsday Syndrome_ : [https://www.worldcat.org/title/doomsday- syndrome/oclc/959523...](https://www.worldcat.org/title/doomsday- syndrome/oclc/959523903&referer=brief_results)), and others, all confirmed cornucopians.

There's a literature from the 1950s - 1960s that I find particularly interesting. It's from a period _before_ the question became hugely politicised (as it did with _Limits to Growth_ ), and when you could find quite sober explorations from both the side of growth and limits. One of the more interesting of these is by Charles Galton Darwin, grandson of Charles Darwin, and with a ludicrously impressive resume. Truth is that human population was exploding in the period after WWII, and concerns were widespread. At least some of the lessening of concern since then can be directly attributed to the awareness-raising. Ophuls was exploring the question itself in his first book, and I think makes the case better and clearer than just about anyone over the case of limits. The fundamental idea being not that there is _some specific_ limit and threshold that can be specified precisely, but that _limits exist_ , and with exponential growth (constant percentage growth), _those are met very quickly_. His read of the likely future trajectories of various countries and world regions -- the US, USSR, Europe, China, India, Africa, and South America, has proved quite accurate IMO. China most especially. Ophuls is a political theorist, and captured the political dynamics well.

The histories of the world through the lens of energy -- Smil and Weissenbacher's books -- are most interesting to me. Weissenbacher is distinctly political, Smil far less so. His "just the facts" approach may be a snoozer for some, but I found it makes the point all the more impressively through its lack of exaggeration or emotion.

I still need to look at Cohen in depth, but am given to believe he's among the most credible demographers looking at the carrying capacity question.</comment></comment></comment></comment>


SnapDesign.io – Custom Snapchat Filters for $35 - <AUTHOR> http://snapdesign.io <comment><AUTHOR> I'd like to share SnapDesign.io. They design Custom Snapchat Geo-filters for only $35/filter. They also have a Messenger bot where you can order straight from Messenger!

website: [http://snapdesign.io](http://snapdesign.io) Bot: [http://m.me/snapdesign.io](http://m.me/snapdesign.io)</comment>


RubyMonk - <AUTHOR> http://rubymonk.com/ <comment><USER2> Just started getting into Ruby myself, and I used Ruby Koans (<http://rubykoans.com>).

Without a doubt the quickest I've ever learned a language. It's such a great way to get your feet wet. No explanations, no nothing. Just dive right into the code and start fixing the errors. You learn a surprising amount in a very short period (took me 2 days to finish 200 koans in my free time).

I've searched for similar stuff for other languages as well. Only found for Python so far. So if anyone knows about these type of tuts for other languages, please share. :)

<comment><USER3> Lua has probably the best "Koans" type problem set I've seen, but they call them "missions": <https://github.com/kikito/lua_missions> . What really sets the Lua missions apart is that it tells an actually story, of sorts, and there is a genuine moment of enlightenment toward the end.

For Clojure there's the entire functional-koans Github account full of good stuff: <https://github.com/functional-koans> . Also, don't miss 4Clojure: <http://www.4clojure.com/>

<comment><USER2> Awesome, thanks! Will definitely try the Clojure ones after I finish going through SICP. :)

For Python beginners, try these: <https://github.com/gregmalcolm/python_koans>

</comment></comment></comment><comment><USER4> What's better than stuffing garish Share on Twitter/Facebook icons around your content? Overloading highlighted text to share itself when you click it. Very cool.

[http://rubymonk.com/learning/books/1/chapters/6-objects/less...](http://rubymonk.com/learning/books/1/chapters/6-objects/lessons/35-introduction- to-objects)

<comment><USER5> This reminds me of this book I purchased on Kindle a while ago. Every time the author made a remark that he felt was "quote-worthy," he would highlight it and add a link to share it on Twitter or Facebook (hashtags and all).

I returned the book.

<comment><AUTHOR> I like it. I think it looks and feels much much better than the standard ubiquitous twitter/fb logos.

</comment></comment></comment><comment><USER6> I actually first found Ruby Monk by searching for "Perl Monk for ruby", so in a way, the name works to their advantage. I know that this site kept coming up on HN radar frequently (in the last year at least) on various occasions, and I am finally glad it has found its own steam at last. :-)

I found Sidu Ponnappa (the guy behind this) to be quite active on many areas/forums/discussion topics (Wonder where/how he finds the time (-: I mean it in a nice way). His blog has some very interesting writings/discussions as well. He's also very vocal about the ongoing state of Indian tech. entrepreneurship, which is quite rare in the current IT ecosystem in India.

I wish him all the very best with all his endeavours.

EDIT: Not associated with them in any way, although the founder appears collaboration worthy IMO ;-)

<comment><USER7> Wow. Thank you! That's quite a complement, and I'm grateful.

I should point out that much of what I say - or write about - are from conversations with my colleagues. I just happen to be the most vocal among us :)

</comment></comment><comment><USER8> I like to see a good amount of competition in the field of learning code. Everyone seems to have a different approach to things and I think the more sites like this the better.

This one seems to cater to the reader-types (I'm one of those) so it's sitting nicely with me. Other people I know seem to prefer video + activity (like Code School, etc). Having these kinds of options is really nice.

One critique: the name is great but when I read the domain, I thought of Perl Monks, just ruby flavored. Not sure if that's good or bad -- just an honest response.

<comment><USER7> Thanks for the feedback (I work at C42 Engineering, the programmers collective behind RubyMonk).

I'd never heard of Perl Monks before you mentioned it - it's something we'll keep in mind. I'm not sure how it will influence us, but it's good to know.

</comment></comment><comment><USER9> I have never seen such a website combine beauty, interesting, and code study together! I think I will soon be immersed in fun coding!

</comment><comment><USER10> Great site and lovely with more sites that teaches people code but I have one suggestion. Make it clear what you have to pay for and what you can access for free. At first, I thought the entire site was free but the "Subscribe" page shows that you can pay $10 for something but not what you will pay for. Please make this more obvious.

<comment><USER11> I'd also make sure the sub information is a bit more clear, but it's a great looking site.

</comment></comment><comment><AUTHOR> I just stumbled across this site browsing from some other ruby site, and thought it looked nice and others might enjoy, didn't know the makers where on HN - great job @kaiwren :)

<comment><USER7> No worries, jfaucett. As a bootstrapped startup with no investors and no connections, we need all the PR we can get :)

So thank you for posting this!

</comment></comment><comment><USER12> RubyMonk rocks!!

Wish there was a HaskellMonk too.. :[

<comment><USER7> It'll be a while yet, but there's a reason we've bought that domain :)

</comment></comment><comment><USER13> I'm totally unfamiliar with the "Monk" label so maybe this suggestion is moot...but a page describing the philosophy of the teaching method and who this book is aimed for would be useful. I'm guessing from the first page ([http://rubymonk.com/learning/books/1/chapters/6-objects/less...](http://rubymonk.com/learning/books/1/chapters/6-objects/lessons/35-introduction- to-objects)) that this isn't meant for total programming newbies.

</comment><comment><USER14> Minor point - the quotation at the bottom of the page looks like it's being attributed to Matz.

<comment><USER7> It is. It's what Matz tweeted after we launched RubyMonk at RubyConf in New Orleans last year. Here's the original tweet he made: <https://twitter.com/yukihiro_matz/status/126447696478347265>

</comment></comment><comment><USER15> RubyMonk is awesome, it's really helping me to do things the 'ruby way'

</comment><comment><USER16> Would be great if it worked on iOS devices. Strange enough, the keyboard doesn't show up when touching a text field.

<comment><USER7> It's a known issue with the js code editor we're using and is something that we need to fix.

Thanks for the heads up!

</comment></comment><comment><USER17> how come this site got to the front page? the site been here for over year??

<comment><USER7> I'm not sure (and I'm not complaining about the publicity :)) - but this is the third time we've made it to HN. Yes, RubyMonk was launched in August 2011, so we've been around for over a year.</comment></comment>


Legal weed is linked to higher junk-food sales - <AUTHOR> https://www.economist.com/graphic-detail/2019/08/16/legal-weed-is-linked-to-higher-junk-food-sales <comment><USER2> Wow the fact that they needed to actually do research into this is mind boggling. Of course weed gives you the munchies. These people obviously have never tried it.

</comment><comment><USER3> So wait, they studied it statistically between states, rather than, you know, empirically?</comment>


White House reportedly moves to eliminate Covid-19 security theater at airports - just-juan-post https://www.theverge.com/2020/9/9/21429462/white-house-trump-covid-airport-screening-security-temperature-check <comment> just-juan-post > Airport screenings are designed to catch infected people traveling into the > country so that they don't continue to spread COVID-19. They don't usually > end up catching that many sick people, though. Temperature checks alone > aren't going to catch people who caught the virus but aren't showing > symptoms yet or anyone who is asymptomatic. Fever is a common symptom of > COVID-19, but some very sick people never develop one. It's also easily > masked by medication. Symptom screenings rely on people telling the truth > and, again, won't flag anyone who is pre-symptomatic or asymptomatic.

It's a step in the right direction to admit that the vast majority of this is "theater".

By continuing the theater we perpetuate the fear. Close the theater.</comment>


Google's Personal Safety app detects car accidents and automatically calls 911 - <AUTHOR> https://www.theverge.com/2019/10/1/20892875/google-pixel-personal-safety-app-car-crash-detection <comment><USER2> That sounds awesome. And I'd love to use it, if it did just that. But I'm confident it'll be bundled with other things that keep phoning home all the time and feeding their data warehouses. I just want to buy the product above, and it does just that, nothing more. Why can't we have this?</comment>


Ask HN: Have any good founder breakup stories? - <AUTHOR>

I don't want to be a gossip, just interested if anyone has any stories to share about how it went, how you got to that point, etc. This is a throwaway account for obvious reasons.
My co-founder and I have had a good run but I think it's about time to part ways. I'm technical, he's non-technical. It seems like it's the same ol' story: We are doomed. He is trying to scale the business before we have customers or a product that has been proven in the market and won't listen to me on anything not technology related (and sometimes even tech-related things go without me). We are already an LLC (we were in the first week, actually) and have divvy'd up C-level titles.
He brought on one of his friends to be our "CFO" and do marketing-related activities. Marketing guy doesn't like the product and thinks we should pivot. So, the product is pivoted and I don't hear about said pivot until the decision has been made and the sales direction has changed ("We need the product to do X now" where X is something entirely unrelated to the domain and requires a herculean effort). He also brought on a guy to do sales -- originally he was supposed to be doing sales but doesn't want to...so is paying someone else to do it which is suboptimal for many reasons.
To get some "initial revenue in the door" the company is getting signed up for consulting gigs. I'm not interested doing them and have concerns about the direction of the company (why do I keep saying company? We aren't a company). I voice the concerns but the proposal is sent anyway. Damn.
The guy is impossible to work with and I feel like a glorified (barely) code monkey working on something I'm not even interested in. He wants to be a "vision guy" but his vision is consistently flawed but refuses to take anyone's input. I feel like I should just go get a 9-5 at this point.
But, another project I started on whim a few weeks back is getting some traction! Unlike this company's product, I actually have users (non-paying, but at least a base of people to bounce my stuff off). So the future isn't entirely bleak, but it's going to be a rough conversation to have.
Edit: Boy, this post sounds pretty whiny. I did do some things -- a lot of things-- wrong. For instance, if we have a product that is not validated against a market there should be no reason for a pivot to be super painful. Likewise, I should have been better at asserting myself when decision time came. So, lessons for the next round, I suppose... <comment><USER2> Wait, they're booking you on consulting gigs to get revenue for a startup company (with probably zero valuation) and you're the only technical guy doing the work? Red flag!

Edit: The point is, unless you are trying to earn money to match a monetary investment they've already made in the company, it doesn't make much sense. You could be pocketing the consulting $ yourself.

<comment><AUTHOR> Heh, yeah I find that pretty scary too. Good point about matching, he has put in a lot of cash already but in a way that I feel like we don't need. Unfortunately the way the gig is structured the cost will absorb the cash we're making (we have some really expensive hardware).

</comment></comment><comment><USER3> I'm on month 8 w/ my co-founder (okay, that's a lie, we've been friends for about 5 years or so), but that "honeymoon" period wears off quick and little things start to creep up.

Communication is key, and so is unity in vision. If you ever have any doubts, then bring it up, even if you brought it up yesterday. This is something that can't be beat to death, and will save you from doing stupid stuff like building things then being like "why did you build that, the customer wanted X" or "i thought we going to focus on Y".

I know you're venting right now so sorry for the long diatribe. Kind of sounds like you're past that point of reconcile. Bummer. Hope things work out.

<comment><AUTHOR> Thanks! Reconciliation isn't nescessarily out of the question. I expressed in no uncertain terms how unhappy I was with a few things earlier, we'll see if my concerns are addressed or not.

<comment><USER4> Dude, you're a co-founder, but you're acting like an undervalued, underpaid employee. Walk away.

</comment></comment></comment><comment><USER4> Walk out.

Offer them your consulting services at x$/hr, where X > 50.

Next time, don't let a co-founder "bring on" people without you involved.

</comment><comment><USER5> At this point it sounds like there's no product, no customers, and no money - and no faith in the success of the enterprise on your part. Based on what has been presented, it doesn't sound like a situation worthy of a significant runway investment. My gut tells me that when a firm has no product and needs consulting gigs, then there isn't enough runway for a successful startup.</comment>


Hollywood's Portrayals of Science and Scientists Are Ridiculous - <AUTHOR> https://blogs.scientificamerican.com/observations/hollywoods-portrayals-of-science-and-scientists-are-ridiculous/ <comment><USER2> Honestly, everything Hollywood portrays is ridiculous. It's not like doctors and scientists have been singled out. How about the manner in which soldiers are portrayed, as unthinking meatheads high on testosterone. There is almost zero nuance.

I can hardly watch films nowadays. I get bored. And I get bored because the tropes are so tired and predictable, that you can tell what's coming. It's cheap and lazy. Were they to focus on better storytelling, I might maintain some interest.

I can see there's going to be some conflict between realistic portrayal and the limitations of the medium. But, all to often so much detail is thrown out that there's little of substance remaining. For really bad cases, the film is a barely intelligible collection of nearly unrelated scenes.

</comment><comment><USER3> Hollywood's portrayals of _everyone_ are ridiculous. Cops. Nurses. Railroad engineers. Librarians. Teachers. Kids. _Everyone._

<comment><USER4> Computers too. E.g. Remember the 3d landscape Unix interface in Jurassic Park?

<comment><USER5> That's totally a real thing: [https://movies.stackexchange.com/questions/9745/is-the- unix-...](https://movies.stackexchange.com/questions/9745/is-the-unix- operating-system-featured-in-jurassic-park-real)

<comment><USER4> Wow I had no idea until now. And I've been using Linux at work for close to a decade.

<comment><USER5> Can't blame you. It's as ridiculous in 2019 as it was in 1993.

</comment></comment></comment></comment></comment><comment><USER6> My favorite is how everyone with an average income lives in a multi-million dollar house. Also when water breaks, character must be rushed into the hospital screaming.

</comment><comment><USER7> News reporting is often similar</comment>


Ask HN: Anyone have a list of distributed companies (remote engineers)? - <AUTHOR>

It would be interesting to compare and contrast work culture and benefits of distributed teams vs fully in-house teams.
I've found a couple big players so far: Automattic: http://toni.org/2010/03/08/5-reasons-why-your-company-should-be-distributed/ Mozilla: http://jasondanielsmith.wordpress.com/2012/01/15/work-culture-differences-xerox-mozilla-and-distributed-teams/
Anyone have any they would like to contribute to this list? <comment><USER2> I feel that distributed teams definetly have many postives, it is just much faster to work in the same building as a person. My startup works via chat room, except for one day a week when we meet in person, and we just get so much more done.

The reason face to face is so much better for us is because so much more information is communicated via talking versus typing. Firstly, the speed one talks usually is faster than their typing speed. Second of all, information is contained in things such as tone, expressions, and gestures, none of which have a digital substitute. Furthermore, it seems that face to face contact facilitates far-reaching conversation about strategy and general topics, rather than just the code at hand. Finally, it is much easier to show someone your error message on your screen, or point to the block of code, than to copy and paste or say line numbers. That final qualm is getting better with the advent of screen sharing though.

</comment><comment><USER3> We at Structum are all distributed. I can tell you that while building iKnode, it has been difficult. Even though we have a very async flow, there is still times where we have trouble integrating.

Google Hangouts has been great, but still, new feature planning seems to work better in-house.

<comment><AUTHOR> Are you planning on keeping Structum distributed, or do you want to bring the team together?

<comment><USER3> Distributed works for us most of the time, so we plan to stick with it. But we are looking for ways to improve the feature planning meetings, which is our major pain point. We usually use the white board a lot, and using virtual whiteboards is not as easy.

So we have thought about three possible ways so far:

1) Making Planning meetings only for major versions only and meet face to face for it in a central location. (This involves traveling).

2) Remove planning meetings all together. Focus on small features and no planning. (Not likely. Being remote requires us to at least sit down and talk about the future.)

3) Invest in better teleconference technologies to improve the interaction between us.(Very expensive, but maybe worth it.)

To be honest, I am looking to #3. I still don't know if it is going to improve the flow though. We are also looking for ways to change the way we work to make those feature planning meetings a lot more interactive using technology only.

<comment><USER4> I am wondering why you would need expensive equipment to teleconference effectively. Aren't there all kinds of web based options you could explore?

</comment></comment></comment></comment><comment><USER5> I'm pretty sure DeviantArt is.

<comment><USER6> Yes it is.</comment></comment>


Crafting a Successful 4-step Conversion Optimization Plan - <AUTHOR> https://www.dynamicyield.com/2014/09/cro-plan/

<comment><AUTHOR> Crafting a successful conversion optimization plan is a tough and complex process. The only type of "magic" involved would be following a well-defined systematic process using strategic and methodical steps. Here's a simple, yet effective, 4-step model.

</comment><comment><USER2> great

<comment><AUTHOR> Thanks gradestack.</comment></comment>


I'm not burned out, I'm pissed off - <AUTHOR> https://www.myname.website/im-not-burned-out-im-pissed-off <comment><USER2> I'm a recovering security guy.

When I listen to security people rant, I can see their points and it's a bit of fun, I like a good rant. But I get the impression that they're continuously discovering new and exciting ways that individual facets of individual pieces of software (and the processes around them) suck. All without ever accepting that the entirety of the software ecosystem sucks (and that they're rarely moving the needle on that front).

All software and the internet combined is a giant ball of mud that just grows and grows as more people add onto it. There's no architecture more than the strict minimum to keep the whole thing from falling apart the moment someone breaths too heavily near it. And that's not even including when commercial interests keep trying to design their chunks of the mudball in unique ways that make themselves more money at the cost of everyone else's chunk getting more complex.

Like everyone else adding mud, security wants to get in, hit their requirements, and get out. I just don't like the chip on their shoulder that nobody else is doing enough to fix the system throughout in a way that helps them achieve their goals with the least fuss.

<comment><USER3> Not really security, but regarding software in general, Mud is one of the reasons I gravitated torwards pure FP languages. It doesn't solve everything, but the added guarantees help shift some of the cognitive burden away from having to dig into every method to have to see what's going on, and I can spend that mental budget elsewhere.

<comment><USER4> This reminds me that "but think of the children" mantra. From my observation programmers often tend to justify / promote their languages/tools/etc under pretense of solving security problems.

<comment><USER3> "Not really security"

</comment></comment></comment></comment><comment><USER5> 1) Increasingly, if you want to be in infosec, you have to learn how to code on the level of a SWE. This is how to not lose your mind when constantly addressing sec issues that others (devs) are entirely responsible for fixing.

2) Department of No doesn't have to be a thing, it just takes some emotional intelligence and pragmatism. 'Always saying no' is as much the fault of the sec eng as it is the system. If you have the will power and general positive mindset, it's more than easy to go through a sec career without getting angry. It just requires not default No, and ....

3) Understand people want to do a good job. If you tell them they're doing a shitty job, they'll tell you to fuck off. If you (sarcasm font) admire what they're doing, and have some stuff that can get added to build an even better product, people are _surprisingly_ amenable to working with you. It seems like 70% of sec folks think their job is to say No, and as a result never get there.

4) This was a huge lesson for me that made me understand the field: to be successful in sec, you __must __learn that your personal risk tolerance will not always equal the enterprise 's risk tolerance. Making money, in a digital field, is an inherently risk-on undertaking. It's crucial to know what to not escalate beyond your team, what to not cause a fuss about, what is just a known risk that will continue to exist, and then have clear requirements for what risk you will escalate and shake cages about.

It seems like all of these sec rants boil down to seeing the system and being unwilling to work within it, vs. seeing the system, accepting it, and figuring out how best to navigate it, and what tools and personal skill sets I'll really have to maximize to succeed in it.

<comment><USER6> I agree with everything you said. To expand on point 3, when you are pitching a security change, know your audience. Most people hear security change and they think another inconvenient pain in the ass that I'm going to have to deal with. That changes if you can show them benefits to people or to the business that are not security related. For example, traditional approach:

Boss: You are advocating spending a lot of money on a configuration management solution, why?

Sec: Well it can help prevent heterogeneity in our environment which can lead to different versions of software being run, some of which may be old and buggy and therefore exploitable.

Dev team: So now we need to do change management meetings and institute even more controls? No, this will slow us down!

Ops: Sigh, another fad system we will have to support, learn, and test.

Boss: This seems like a lot of money and inconvenience for a theoretical problem, no.

Better approach:

Boss: You are advocating spending a lot of money on a configuration management solution, why?

Sec: Because it's a win for the business. Our Dev teams can avoid dependency hell and be confident that code they develop on their machines is going to work in production because our production environment will mirror the development environment. This will let them ship faster and spend more time doing real work. Ops will be able to scale much faster and spend less time dealing with configuration issues. Imagine being able to develop a config and spin up 50 servers with it at the same time while you sit back and sip a soda! No more fixing damaged boxes, just replace them! No more fighting with the dev teams! Oh yeah, we also get a security benefit for free while making our lives easier as we won't have to deal with heterogeneous software running on our boxes which presents a security vuln. The ROI for the business will be large.

Everyone: wow sounds great, let's do it!

</comment></comment><comment><USER7> I 100% agree as a consultant working in product development. I think what drives this is a lack of ability for anyone to understand the end-to-end product from a technical standpoint and make coordinated decisions about direction. Instead, you have 30 teams with their own architects and roadmaps (which often overlap functionality) so you build the same thing 5 times across the org, then 3 of them end up drawing meaningful adoption so you have to figure out how to support that on an ongoing basis.

All of this leads to non-technical sales people becoming the de-facto source of product feedback. Which leads to non-technical middle managers making product decisions with a short-term mindset. It's impossible to do a good job under conditions like this, so folks just check out and clock their 40 per week.

I think this is the cause of a lot of burnout. People get emotionally invested in their work, but the way tech is structured, quality doesn't matter as much as velocity. Individuals don't fully understand how much impact their work has, so it can seem like toiling away in obscurity for years on end. That doesn't feel good to anyone, but when the company is making 35% margins it's really easy for them to ignore the cash bonfire.

<comment><USER8> I experienced this several times as an employee. It becomes hard to stand when you realize that every positive contribution just results in more money being shoveled out of the window behind your back (mainly because of greed, inefficiency, keeping the status quo, and wreckless behaviour caused by trust in your capabilities to somehow fix it again, every time over again) -- as opposed to contributing to a more efficient way of working for everyone.

Been doing extreme over-hours in the hope of fixing stuff once and for ever, only to realize your job becomes more and more like shit-shoveling, since management starts to feel invincible (and protected by your contributions), which leads them to make even more errors without accountability. I've seen some of them with tears in their eyes when I finally quit. 'nuff said. Profiteurs!

<comment><USER9> > Been doing extreme over-hours in the hope of fixing stuff once and for ever, > only to realize your job becomes more and more like shit-shoveling, since > management starts to feel invincible (and protected by your contributions)

Isn't that when you start earning a lot of money?

<comment><USER10> > Isn't that when you start earning a lot of money?

This is very dangerous thinking. Figure out why this true if it is not already obvious.

* Not sustainable * Not healthy * Not scalable

No sarcasm here. Try to avoid this thinking-trap.

<comment><USER8> Correct. Also, they won't give you that money if they know your motivation is the will to fix things. The money flows instead to the ones who have receiving more money as their motivation.

</comment></comment></comment></comment></comment><comment><USER11> "A new car built by my company leaves somewhere traveling at 60 mph. The rear differential locks up. The car crashes and burns with everyone trapped inside. Now, should we initiate a recall? Take the number of vehicles in the field, A, multiply by the probable rate of failure, B, multiply by the average out-of- court settlement, C. A times B times C equals X. If X is less than the cost of a recall, we don't do one."

No one in management wants the expense or the overhead of actual security. They want the "theater" of security, the good feeling, the box to check on their resume (as management) so everyone can pretend everything is fine and go back to the business at hand. Then something real happens, a leak of user data, or credit cards or internal memos... suddenly everyones job is security and no one knows what to do. The last problem gets solved, there is more "theater" and a few quickly forgotten changes that get worked around or just ignored in the long run.

Furthermore your average engineer wouldn't eat a ham sandwich handed to them on the street by a stranger but will happily run code from 100's of other people on their servers with out even looking at it. Note: I too am guilty as charged. Sure you can vendor it, and miss out on future security patches (it was already broken). Or you could just pull it from whatever repo you got it from to begin with and pick up new flaws. Never mind the fact that pulling from random places assumes that all those other chains of trust remain un- compromised.

Management and Engineers should be the ones most concerend and most thoughtful regarding security and both seem to ignore it for cost and convenience reasons till it is (far too late and) a REAL problem.

<comment><USER12> For those who didn't get the reference:

The OP is quoting Tyler Durden, a fictional character of the movie 'fight club'. So take it with a grain of salt.

<comment><USER13> Or, take it for what it is, a _quote_ from a _movie_.

But don't dismiss the merits of the idea. It's essential Risk Management[0], which is most certainly a relevant part of Information Security. Specifically, this is a form of Cost-Benefit Analysis (specifically, Qunatativie Risk Analysis[1]), a critical component in proper Risk Management; the reality is you cannot "fix" every issue.

Take a look at methods like Single Loss Expectancy[2] and Annualized Loss Expectancy[3]; you'll find that the _Fight Club_ quote is very close to the real-world methodology. I cannot speak for the Automobile Insurance industry, but given Insurance is founded in Risk Management, it seems likely to be closer to reality than not.

[0] [https://en.wikipedia.org/wiki/Risk_management](https://en.wikipedia.org/wiki/Risk_management)

[1] [https://csrc.nist.gov/csrc/media/publications/conference- pap...](https://csrc.nist.gov/csrc/media/publications/conference- paper/1999/10/21/proceedings-of-the-22nd-nissc-1999/documents/papers/p28.pdf)

[2] [https://en.wikipedia.org/wiki/Single- loss_expectancy](https://en.wikipedia.org/wiki/Single-loss_expectancy)

[3] [https://en.wikipedia.org/wiki/Annualized_loss_expectancy](https://en.wikipedia.org/wiki/Annualized_loss_expectancy)

</comment></comment></comment><comment><USER14> If you work in security, this resonates so much. No one really cares about security except to check a box or pay lip service to it. That's why so called security products ship without logging and clients don't want to make the smallest effort to enable you to improve their security. It's why companies that sell security products invest more in marketing than the product. The industry is full of conmen and marketeers. Information security can be great though if you find someone that really cares.

<comment><USER15> I work as a contractor for a bank.

A few months ago everybody was up in arms about a "major" security issue discovered by an auditor (you could see the settings of random users by changing an id in a url). I've just shown them you can credit money to your account, yet this is low priority and they provided a fix that I'm 100% percent sure didn't fix anything, unfortunately the functionality is down on all but the production environment. I'm tempted to just credit myself 1 monetary unit in production and just show them the statement.

<comment><USER16> > I'm tempted to just credit myself 1 monetary unit in production and just > show them the statement.

I would be tempted too, though I could bet that this will be a termination of an employment, instead of the problem being fixed.

I would like to be proven wrong on this speculation..

<comment><USER15> Yes, that's what I thought as well.I'll just have to suck it up until the test environments are up again and provide a proof of concept exploit.

I'm just impatient because it's a really clever and somewhat complex hack that challenges some multi-threading and transactionability assumptions some people mande and I can't really talk about it(which I'd love to share with my peers).

<comment><USER17> Raducule, did you did CYA (cover your ass)? E-mail(s) to higher ups responsible in case of a fuck-up that most likely will happen in the future? Do it now if you didn't, or "wave and smile" if you did. Let them burn if you are ignored, no longer your problem.

</comment></comment></comment></comment></comment><comment><USER18> I asked my SO recently how she view the Internet, what it is and how it works. She was honest and told me that, "If I click this button, this websites loads. If that works I'm fine! If it doesn't I will call you. Don't stop working with IT please, if you get it, we need you badly!"

I believe that is a good reason to be accepting towards the current state of affairs. People just don't care. They have more important issues to deal with, deadlines to meet, problems to face.

If you are frustrated and pissed off, great. That means you get it, and that's great!

Now, meditate -- the journey to a perfect secure world will take some time, like beyond your current life span. It's not until you accept that reality that you will make real change globally. Because it takes time, a lot of time.

Thanks for your effort so far.

<comment><USER19> Thing is, it took me a long time to accept that people not caring was ok.

Now I realize that my dad is frustrated I never learned something as simple as changing the oil on my car.

My mom does not understand how I can't name more than two flowers and can't bake a pie.

My legal-minded friends are astounded I do not take a day to work on my legal status to pay less taxes. Hell, my wife does the paperwork I am not even sure of the tax rate we are paying.

And yet, I see myself as pretty curious, jack of all trade. I understand many things about CS, mechanics, electronics, manufacturing, politics, economics, ecology... We live in a complex world and we rely on each other to make it work.

Love each other, we really depend on each other, it is easier if we don't consider others stupid for choosing different areas of skills.

<comment><USER20> I can't accept that not caring is ok. The small "I don't care" extends into "I don't care about anything outside my immediate environment" and that has political and eventually global consequences.

If their bank account is drained they will care, and get angry, and then maybe do something (but preferably the bank will recompense them in which case they feel better and go back to not caring).

Some stuff you just can't do; as you say the world's too large, but many people don't want to put in the effort to learn stuff that would benefit them immediately, never mind over the longer term.

I really do not understand people.

<comment><USER21> > I really do not understand people.

Well, then learning more about people's psychology and motivations seems like a thing you could benefit from immediately :)

<comment><USER20> I realise people don't care. I don't understand how they can so freely ignore that this has consequences and not always even long term ones.

Given that I do recognise people won't change, would it help if I did learn to understand their builtin magic curtain / SEP field[0]?

I ask with no hope any more, what do you advise?

[0] [https://en.wikipedia.org/wiki/SEP_field](https://en.wikipedia.org/wiki/SEP_field)

<comment><USER18> It's like a runner that runs laps, if they can keep going they will. Sometimes they need support but then they only do a pit stop. Getting information or acquire a skill with that state of mind makes you only learn what seems essential to you.

Being acceptant of that has the upside that you don't need to know the background of a given individual (some people have a rough life, others just don't think they will get it e.g. think they are not smart enough, others are just working 400% and have kids), to accept the fact that they will just use tech and maybe don't care about the inner workings. But is that really a bad thing? Because that's exactly how they are built know adays, ease of use.

I have people around me that I want to explain basic things in life to, but.. even if they actually listen their previous argument float to the surface the next day. People need to change themselves.

In the other end of the park there's a big playground. That's where I sit and design the biggest sand castle I've ever built. I don't care that much about running around, I switch playground when I have too.

Each mindset have their pros and cons. I solve stuff that takes a bit of effort. My SO keeps our life/house running.

So respect and acceptance about others choices is a great way to let go of anger that nobody is interested in the things you are interested in. Finding someone with the same mindset in real life is rare, even on HN. How cool is that?

</comment></comment></comment></comment></comment></comment><comment><USER22> The problem with the security mindset is that security goals are relative to other business goals within almost every organization. A breach can be OK. A rebuild can be OK. Some downtime can be OK. It depends on the system. To put it eloquently: _I don 't trust security people to do sane things._ \- Linus Torvalds (2017) ... via [https://github.com/globalcitizen/taoup](https://github.com/globalcitizen/taoup)

<comment><USER23> Indeed, if you are a security engineer, everything looks like a threat to you. Therefore, a developer's workstation must be protected just as strongly as a critical database server - at the gross expense, of course, of the developer's productivity.

<comment><USER24> I once worked somewhere as a contractor where developers had 3 separate PCs with a KVM switch - with there being separate development, test and production infrastructure.

Ironically they had a serious production incident that almost took the entire (large) company out for a day because they were doing load testing in one environment (they had about 10 separate environments) but they had shared email infrastructure between production and the production-1 environment. The application being tested generated zillions of emails using "real" email addresses that clogged up their production environment.

<comment><USER25> My worst: Developer machines were dumb (but secure) terminals for remote desktop connections to a jump box, where a VNC connection got us to a Linux desktop living on AWS GovCloud where actual development took place.

It was a remarkably risk-averse client.

</comment></comment></comment></comment><comment><USER26> I don't explicitly work in security, but I've had a handful of arguments in the past where I've discovered a serious vulnerability, and been told either by my managers or by a client that it is low-priority.

Sometimes, the vulnerability was then exploited, and what shocked me was that people were okay with this. I won't name names, but one marketing department I worked with was happier to suffer a customer data leak over having to spend budget during the end of the year to fix the issue. I later learned that the IT department got in trouble for allowing the error to happen, when the system was entirely managed by us and our sole point of contact was with someone in marketing that left their position because they didn't get on with IT.

If there's one thing I learned, it's that the ultimate currency in business is risk, and that the software/IT industry lacks the power to really do anything when a company is found to be negligent. For many, the risk of "being caught" is worth not spending money on preventative issues, and ultimately there's absolutely nothing we can do about it outside of covering our asses when the finger is pointed our way.

You only need to look at the Panera Bread security breach to see that all the badmouthing on Twitter did nothing to stop the company from painting its own narrative. Hell, the WordPress theme/plugin company Pipdig was caught ddosing its rivals with their software, and all they had to do was lay low on social media for a month and lie in a blog post. The worst part was that their non- techie customers were all too happy to back them up, meaning that the WordPress security community had zero clout to really do anything.

I have the utmost respect for anyone that works in security, because you're fighting a battle that no one wants to win, and is often a battle where it feels your partners are silently rooting for the other side.

<comment><USER27> I worked at a healthcare company in the US (we provided HIPAA data connections between insurance and providers) and discovered all the production passwords were storied in a text file in the code repo half the company had access to. The CTO told me "we trust our employees". There was also no auditing on who access the DB and servers, and they never changed the passwords because the chief architect did not want to remember anything.

<comment><USER28> I worked at a retailer (not Target) that did something similar. Once Target got breached in 2014, they mandated security training and began making changes to some things in the org. This was one - instead of storing those passwords in plain-text, they were encrypted. So people encrypted them, commited them into the repositories, and deployed the now encrypted files to production. Cool, right?

They didn't actually change the passwords, since that would break too many things at once. So you could just look at the git history to get the plain text password. Or debug the application locally.

Security theater all day. Sigh.

<comment><USER26> There's something both comforting and absolutely terrifying that everyone has similar stories of software negligence.

I would love to see a whistle-blower company formed, where you could report software engineering malpractice, and be compensated and/or protected from being punished. Not necessarily a union, but an industry body that could verify your security concerns and either "out" a company for punishing you, or provide you x months of work and a reference to compensate the termination of your employment.

</comment></comment></comment></comment><comment><USER29> The bad news is that this will happen everywhere where you work for someone else, especially in large companies.

And this cannot be avoided while working as an employee, it's part of the system.

The good news is that there is one way to avoid this (the only way AFIK) is to start your own company, there you get to call all the shots for good or for bad.

It doesn't have to be a big company though, it can be just you and a laptop for starters.

Other than that, as an emotional coping mechanism and to preserve their mental sanity, people will simply become disengaged and cynical.

Take longer breaks and try to have a laugh with your colleagues to blow some pressure and make friends.

Also, because things work badly in those environments, there is a lot of blame deflection going on, which is one of the main causes of stress and burnout.

Again, part of the system, not much that you can do about it other than learning to deflect responsibilities to others.

Getting rid of the hot potato is a very important skill in these corporate settings.

Usually on a team, it's always the same people getting the short end of the stick. Try not to be one of them if you can, but often that's easier said than done.

Also, try to get promoted, you will get more responsibility and might even be able to fix some of these things, that's another positive attitude towards chaos that helps a lot of people cope with it.

<comment><USER30> I couldn't disagree more. I work for the government (in R&D) of all places (about as close as possible to the opposite of working for myself IMO) and I don't feel this at all. I have near-total control over my work environment. If I need something, all I have to do is articulate why I need it and I will get it or get a precise technical explanation of why I can't have it.

<comment><USER29> That's a very special setting, most enterprises aren't like that. For example, for material, you get a crap old PC where you can hardly run your IDE, where you can't install anything.

These days it's doable to at least get a second monitor. But for things such as an SSD drive? At least a couple of years ago it was nearly impossible.

The reason why burnout is frequent, is because in general in most places work conditions are bad and stressful. In my view the problem is the system and not the people.

Your professional setting seems like a good example of how it doesn't have to be like that.

</comment></comment></comment><comment><USER31> This is the down-side of artificial scarcity for software. The upside is that sweet sweet green. If you could remain cynical a few years longer, scrimp and save like 10 years of a comfy mid 6 figure salary, you'd stop caring about the BS, and you'd might even learn to love it (or even contribute to it!) After all, nothing quite feels as good as being a well-paid expert in a complicated field, especially when it grows more complicated over time.

It's offensive, and it's not how it should be, it's a "defect/defect" Nash equilibrium when we should be going for "cooperate/cooperate". So kudos to you for fighting the good fight - you deserve to win.

<comment><USER32> > artificial scarcity for software

Can you elaborate on this? Why would you say there is artificial scarcity for software?

<comment><USER31> Software costs ~0 to copy and distribute absolutely perfect copies, world- wide. To drive the price up you create artificial scarcity, mostly rooted in IP law.

Important note for HN readers: 'driving the price up' is a net benefit for programmers. Artificial scarcity is why you get paid big bucks.

Interestingly, _data_ is legitimately scarce. But that's a discussion for another time...

<comment><USER33> Copy and distribution costs are just a part of the cost. Development and maintenance does require real flesh and blood people spending their days working on developing, building, and deployment. That part costs money.

<comment><USER31> You tacitly assume that I am not aware that software products have an R&D cost, and you are (insultingly) wrong. Of course they do. And without artificial scarcity that R&D cost _will not_ be recouped. The default state of software is an open source model, where the "developing, building, and deployment" doesn't cost money because there isn't any.

<comment><USER34> Copy and distribution costs for movies in a digital age are non existant. Are movies using artificial scarcity?

<comment><USER35> That movies are almost impossible to buy DRM-free should give you a hint ?

</comment></comment></comment></comment></comment></comment></comment><comment><USER36> We're creating more complexity every day. Kubernetes, microservices, microfrontends, "big data" lakes, etc etc. Now instead of securing a physical server, or even a VM, you have to somehow secure thousands of interconnected endpoints in PaaS products in a cloud you can't even debug appropriately. Is it a surprise our software is worse than ever these days?

We've added complexity but we haven't increased our capabilities. What software can we make today that we couldn't 10 years ago? I'll even stipulate there could be a few examples, but 99% of the stuff we build today could have been built faster, cheaper and secured easier 10 years ago.

</comment><comment><USER37> Basically everyone wants security, but nobody wants to pay for it.

Maybe the market equilibrium means people don't get hurt enough yet.

<comment><USER38> Everybody wanna be a bodybuilder. But ain't nobody wanna lift no heavy-ass weight.

[https://www.invidio.us/watch?v=4UlgXIL0-3g](https://www.invidio.us/watch?v=4UlgXIL0-3g)

<comment><USER39> good ole ronnie coleman.

</comment></comment></comment><comment><USER40> I think this person should seek happiness in ways that don't involve technology.

<comment><USER41> They're expecting greatness from everyone around them. That would drive me crazy as well. My mental health is too important to be idealistic anymore.

<comment><USER42> When I was in my early 20s I couldn't understand why people were so jaded about anything. A decade later and, I understand.

People don't give a damn and it's mind-boggling. All you can do is shake your head and continue with your day.

</comment></comment></comment><comment><USER43> It seems a lot of people here find information security to be of utmost importance.

I would like you to consider a contrarian position. What if someone said cybersecurity (as in information security) is not very important? [http://www.dtc.umn.edu/~odlyzko/doc/cyberinsecurity.pdf](http://www.dtc.umn.edu/~odlyzko/doc/cyberinsecurity.pdf)

<comment><USER44> I disagree. The contours of our world are shaped by the quality of our cybersecurity, to the point that it's the water we swim in and we just don't see it any more.

Some examples: The last US election was won in large part through highly- targeted influence campaigns run based on stolen data. Not to mention the triggering of Brexit. The influence of the NSA / Russia / Five Eyes / etc on geopolitics hinges on poor cybersecurity. I think it would be silly to assume all of the recent leaks we see come from "inside the building".

The entire economics and solution space of what is possible on the internet is shaped by our cybersecurity standards. What would the internet look like if payments and spam were easy instead of hard, or if DDOS was hard instead of easy? I might hazard a guess that this is one factor of many that drives the centralisation of tech into monopolies.

A positive externality: The general failure of the tech industry to develop good content protection has enabled widespread software and media piracy. I might suspect this has allowed second and third world countries to uplift faster than otherwise possible (sci-hub anyone?) while also removing a tool of empire from the first world.

</comment></comment><comment><USER45> Why would you need an InfoSec if security was a solved problem?

By the way, I totally understand where they're coming from, but I've realized that as an engineer in enterprise, your job is to fix things that are falling apart. The more senior and talented you become, the more broken the things they want you to fix become. That's literally your job!

They're not going to pay you to admire the beauty of something without issue that meets all requirements.

</comment><comment><USER46> >I'm mad that I sat on a call representing my company's (not cloud native) cloud offering listening to Cisco tell us that the only way to get logs from god damned IRONPORT in the cloud was to use syslog! OVER THE INTERNET. FOR SECURITY LOGS.

Why is this an issue? This is how syslog works on literally every device ever, you set a destination and it streams it over UDP with optional authentication/encryption. If you want to do something hokey like consume logs over an api (what?) set up a syslog gateway and configure log retrieval how you like. You can't be mad at a vendor for not supporting your crazy log consumption scheme -- logs are push (generated), not a pull or sub or whatever you're trying to do.

A normal setup would be to have a logging cluster (elasticsearch or similar). Feed logs into it via syslog or logstash or beats or whatever other bajillion plugins there are, then get logs out via the ES api (or even better, do your analysis straight in ES).

The author just sounds mad he has to do actual work instead of attaching one product to another and collecting a paycheque for it.

<comment><USER47> Syslog is a plain text protocol. Sending that over the internet kinda defeats the purpose of security logging. The problem isn't with syslog (although like the post says, syslog is still a problem for security). The problem is syslog over the internet.

</comment></comment><comment><USER48> Thanks for the essay. I've often seen, and myself felt the frustration of the productivity mismatch of having to work with other teams, vendors, and third party products that drag their heels, are rigid, or inflexible.

When your day-to-day involves writing code — putting together hundreds of moving parts in a code editor and shipping levels of complexity orders of magnitude greater than any previous era of the Industrial Age — it can be a real drag to get slowed down by things that _aren't_ code.

We have to work as teams of course, and it's enriching when you're all on the same page. People scoff at mission and statements and company values, but once you start working with an external vendor you realize the importance of the literal meaning of _company_. When you're forced to work with something inflexible it's ok to hack around it. It's our bread and butter to do so.

But having to hack around things will build a sense of resentment especially when it happens over and over again, and in particular if you ever find yourself doing that to an internal product it can be a serious enough red flag to require some major org changes.

</comment><comment><USER49> This guy needs to understand his place in the workings of everyone around him, just like his product's place in the workings of the products around it. If you provide a product with a function that is transparent to the user unless it breaks, then they're going to place their priorities where the needs are most obvious and rewarding. The people who use his products have jobs with focuses are something other than his security product. Their priority will always be on what they have to do to earn their money. A corollary to earning money is saving money. As far as the product never arriving at its ideal function goes, the products that his security products serve will always evolve, so his product will always have to change with them. You can only let these things get to you so much. Source: I was responsible for the surgical equipment for a hospital. You want to see reality avoidance and cost-priorites get ugly?

</comment><comment><USER50> This post resonates very well with me. I am in the exact same position, possibly more frustrated because of our naïve attitude towards building security.

</comment><comment><USER51> Ah, syslog. Around 18 years ago I was part of an group developing the next syslog protocol with security in mind. My company (one of the top infosec firms at the time) had a product doing this already.

The standards group was a mess. Some other company without any credible security credentials was just forcing their bad implementation (TCP (!) and yet another protocol layer). They were backed by Microsoft and some other corporation. Cisco member just idling there. I ended up leaving as it was a waste of time. Never even bothered checking what happened with those protocols. But I've never heard of them again.

(tinfoil hat on) I think the Microsoft guys sabotaged it on purpose and succeeded.

<comment><USER46> Don't know about what group you're talking about but it ended up well: no need for a new protocol, just wrap in TLS with mutual cert authentication. TLS/TCP is fast enough nowadays that the overhead doesn't matter, and it saves you from having yet another standard.

<comment><USER51> But they did create a protocol with even more layers.

Also our solution did not need two way communication (as per TCP) but had encryption. This is key in a lot of infrastructure when you change environments (e.g. DMZ to some internal subnet). TCP and SSL were supported, too. Our software was used by one of the larges Unix installations and one of the largest telcos in the world. While theirs, not so much.

</comment></comment></comment><comment><USER39> I also work for a security product vendor and this 100% reflects exactly how I feel. My god you'd think I wrote this.

I'm still very upset that my employers product doesn't have particular features but what i've come to realize is that we don't have feature X because the competitor doesn't have feature X.

If someone was to buck the trend and just try and be the best vendor possible because its what users deserve that would completely disrupt the industry.

I completely understand this thinking but im tired of hearing that the dev team is developing feature Y that only 1 customer will use simply because they are a fortune 500 customer.

</comment><comment><USER52> I feel like a large part of the responsibility lies with the people implementing these networks to be able to document, compatramentalize, and organize these various systems in the least convoluted manner.

The biggest problems I see achieving that are all the different ways of accomplishing the same goals. For example, many endpoints in a network will have 3 or 4 DRM agents on them for licensing certain products. What do they connect to? What are they sending? What infrastructure variables need to be in place to support those connections? How do I configure or troubleshoot this service/ connections?

Most of these agents are critically ineffectual and simply add bloat. I've done pentests in my own environment and broken, cracked, or bypassed three. My point is, the company who hired you can't change their entire operation because of your requirements. That's why we go to work. Especially at small or medium size businesses with limited resources.

"Stop using the ERP system with 12gb of data that you've had 30 people using for the past 15 years! We found a bug and the vendor won't fix it!"

You can see how that's not viable. So you find a way to mitigate the bug yourself.

"You need to get rid of XXX in engineering. They keep falling for phishing emails."

No. You need to find some resources or setup training to combat phishing. Create rules or modify this person's environment to reduce surface area and increase visibility on that endpoint.

And sometimes you can't solve it! But you can usually pick off some low hanging fruit and iterate to a more secure state than you started at.

<comment><USER53> > You need to find some resources or setup training to combat phishing.

Honesty it's so bad I think we're best off just figuring out ways to do away with email as a primary communication mechanism altogether. When my company was smaller we had more technically savvy people, but as we've grown the average level of competence has sunk just to meet staffing needs and it's impossible to keep up with training and expect people to actually really listen.

So if I had my druthers it would be a blanket ban on email for all internal communication. Formal taskings get done through a PM tool, general requests for information done through Slack, and documents managed and shared by the GDrive.

Email restricted only to communication with outside partners. All links and URLs are blocked. All attachments are stripped and send an email telling them to send it via an upload portal that pings the person on Slack that they have a [filename] waiting for them.

Part of the problem is how much we've habituated people's email habits to behave badly. We tell people over and over again not to blindly click URLs, and then by default Microsoft Teams is here emailing people every time they get mentioned in a chat with a big "view in Teams" button to click through. Users get mixed messages all the time so can we blame them for not knowing what to do?

And the worst part is that the worst actors in this request are senior executives. The higher up the chain the less regard they have for following established processes.

</comment></comment><comment><USER42> A buddy of mine works in security and I can see him writing this post, haha.

Or did he?

Anyhoo, I cannot imagine working in a technology field and not being allowed to do your damn job. Sounds frustrating af, I'd quit too.

</comment><comment><USER54> You are not pissed off, you are burned out.

When all the people around you are fine and you can't cope with the environment, it's time to look for professional help, for your sake.

<comment><USER55> I don't think he/she is burned out. When you are burned out you can't do anything anymore. Then you are way over 'being pissed off'.

But! being pissed off at work is a very good way to get burned out. Most people who are burned out are having conflicts with their moral and what they do or how they live.

So good for the author to make this clear to his boss and is taking action. Because in the end being mad will turn into being burned out.

</comment></comment><comment><USER56> Don't you think that most of your clients being breached is immaterial in the greater scheme of things?

You seem to be bothered by the "overall picture". I am also prone to this sentiment (not in infosec though) but I am actually consoled by the sort of nihilist nature of things. Maybe even optimistic for being so. I think the stuff that keeps us happy are minutiae.

If you are super keen about APIs then maybe building really sensible APIs along the way will bring you the relief of having something stimulating to work on. At the moment I get a lot of satisfaction from tooling vim to be my super-IDE and everytime I use vim now I get a kind of wry happiness from not having to use all kinds of apps and what-not. I think APIs can be super interesting and useful. For example, I wanted to pull the Bitcoin purchasing history from a site and the answer was... you have to use Golang.

I also get a sort of satisfaction from using Perl in this way. (I use Python too.) It's just that all kinds of wonderful gems were once written in Perl by people that were clearly bored with their lives (exiftool comes to mind).

</comment><comment><USER57> 15 years ago, a classmate of mine went into security and had a similar state soon after. He decided that the entire industry was either snake-oil, or installing a 3rd deadbolt on the front door to a house with open windows.

He quit the security field, became a DBA, and moved to be close to his family in the midwest, collecting a an annual paycheck roughly equal to the cost of a 4BR house there.

</comment><comment><USER58> While a lot of what the author notes about the issues with security are reasonable complaints, it sounds like the real problem is that the author is burned out because of how all of these underlying issues are dumped onto him as his problems. The real problem is not all of these real world issues that end up effecting him, it is that his work relationships and responsibilities turn these technical issues into personal ones. His response is not to really level with his boss and negotiate a better work circumstance, but instead to vent about how it is the fault of the technical integrity of the entire industry that he has to deal with his boss, his clients, and his workloads. The real problem with the industry is that too few people in it manage interpersonal expectations and boundaries. Instead, it's all too common to hear people in this space to transform interpersonal issues into obnoxious technical gripes, and that only enables the interpersonal dimension to erode further.

<comment><USER59> I don't know... The opposite of doing what the author does would be what? Arrange his work so that it's not all his problems? Adopt the mindset of "code to spec, collect paycheck"? To me, the author comes across as caring. They _care_ about the actual value of the work they're doing, beyond their salary. We desperately need more people like that in this industry, because a lot of problems essentially boil down to it being full of people who don't care in the slightest.

</comment></comment><comment><USER60> I also work for a cybersecurity vendor and what I am witnessing at work looks a little similar to other comments here.

Every feature and improvement goes through the same cycle:

\- Sales come with user stories/feedback

\- Boss distort the needs and comes up with a solution that's good for nobody

\- The engineering team tries to reason the boss into meeting the actual needs and fails 9 times out of 10 because he knows better

\- The feature is carefully designed to be as secure, user friendly and efficient as possible

\- Boss ruins the UX and security by inventing ridiculous constraints, sometime saying that we can improve on it later

\- Insecure and user hostile feature get released in the next software version

Of course boss and sales advertise the product as the next generation of cyber security product, better than anything already out there. I've not been working here for a long time but I know I will get tired of this stuff very quickly.

</comment><comment><USER61> The main thing here is that a company that can't directly tie security to revenue will NEVER value it the way that security people think it should be valued.

I can't count the number of times that some wanker used the words "I will sign off on the risk" when they didn't understand the risk that they were putting off on departments that they had no authority over. What they were really saying was, "I can tell you what to do".

The truth of the thing is that business doesn't care about something being right if it can save a single penny by doing it wrong...the only way that changes is if the cost of doing it wrong becomes dramatically higher than the the savings gained from cutting corners. The operative word there is "dramatically". See the fines that companies pay to regulators when caught breaking the law as evidence.

</comment><comment><USER62> > I'm pissed off at the state of information security [...] I'm pissed off > that our tooling is falling behind. I'm pissed off that my clients don't > seem to take it seriously

Information security, like physical security, isn't something people want to have to care about or put effort in, and if they don't want to, they often won't. What you should be pissed about is that clients have to care and it isn't applied transparently. When being insecure is more difficult than being secure, then you'll find the mindset shift. In the meantime, you should be pissed off at those that make security difficult, not those that care less to endure those difficulties. I know some of the post addresses vendors, but the rest concerning your-company software and vendors is misplaced anger.

</comment><comment><USER63> Does anyone care to explain what the big issue with syslog is? I've been using syslog-ng in production for years and it's performance has been flawless. Is there something I'm missing re: security? Is the issue the weakly-structured log formats?

</comment><comment><USER64> Humans suck. They are mostly social creatures who follow social instincts to gain social credit. Logic and efficiency play a back seat to those goals. If you pretend or hope they'll become like Vulcans, you will be repeatedly disappointed.

</comment><comment><USER65> As well he should be. So should we all.

</comment><comment><USER66> The lesson is so simple and it's all over the place: in the late term economic cycle, economical interest doesnt align with the ones of the individual.

Economy have to growth, create artificial scarcity, complexity, jobs, etc, and after a while this gets so easy to spot that starts to annoy, normally from this phase you end up in a global war in fact, so at least wont last! XD

</comment><comment><USER67> Sometimes the best way to solve a problem is to stop participating in it. Why do the security breaches matter so much in the first place?

If the risk is so high and the security so bad, stop using the technology for things that demand more than provided protection.

Otherwise it makes it sound as if we are being sold snake oil. (Hint it's a stepped approach that starts with being disconnected to the internet.)

<comment><USER68> I wonder if the idea of storing large amounts of sensitive data for use in internet connected systems is even something we should be doing. With how complex system are now, it's almost inevitable something or someone will cause a breach, knowingly or not.

It probably doesn't work in many countries due to "Know Your Customer" style laws, but in my systems I throw away all but absolutely required data as I just don't want the liability. Sometimes that means I just keep a username and password hash.

</comment></comment><comment><USER69> I think it's kind of funny how burn out was previously described and how it really is. I think that if I had challenging interesting work, and my work reviews also matched my efforts, I could come into work every day and work really hard. But if either of those things are out of balance, it gets really hard to keep motivated and wake up in the morning.

</comment><comment><USER70> I think this is similar to the experience of almost any competent person when dealing with corporate lunacy.

</comment><comment><USER71> I can relate to the author. Worked for now acquired payment gateway that was for PCI compliance level 1 (over 6 million transactions a year). Getting upset over outdated practices by either the company or the security company testing our software was regular.

</comment><comment><USER72> No bud, you are burned out. You give too much shit about what is ultimately someone else's business and company. If you don't stop doing that, you will be burned out no matter where you go and what you do.

</comment><comment><USER73> Security companies exist simply to mark a check box on most industry's "Cover my ass" list. If you are pissed off maybe move out of this and into a sector that actually cares about security.

</comment><comment><USER74> This is what burnout means. It's learning that it's impossible to succeed at your task, sapping your motivation to work on it.

</comment><comment><USER75> The fundamental problem is IT is engineered at a price-point two to three orders of magnitude lower than what the complexity demands.

</comment><comment><USER76> Well, the entire purpose of the infosec industry is to cover for the sh*t practices in the software development industry (and no it ain't engineering what most of these people practice).

So you have to expect that if your vendor is CADT your security is going to be full of holes and undiscovered bugs, critical missing features/etc. Move fast and break things also means shed-loads of bugs, many of which could be exploited by an enterprising individual for gain.

</comment><comment><USER77> what if I tell you that a software banks (B-A-N-K-S) are using to transfer money has hardwired passwords inside, has to run as administrator and has some problems of command injection, etc, etc ... etc ? Sadly company think to security as a cost and to maximize the profit let people should never approach a keyboard to write programs, unsecure programs, because they cost less. Because also testing is expensive, same story. Did a big airplane manufacturer does the same ? The customers ? Who takes decision often doesn't care: they prefer to spend more money to purchase a scapegoat, a "silver bullet" appliance so that they can say "Hey, we had all the contromeasure, but hackers know black magic !". I don't want to burn-out. I prefer to give the correct information to the peoples want to listen and then I hope in a future in a better company.

<comment><USER78> I assume English isn't your first language, so this is my attempt to correct. Please don't take this as a criticism, but rather as (hopefully) helpful feedback. Even with English as my native language, I'm sure there's some grammar mistake I've made as well.

____

What if I told you that the software banks are using to transfer money has passwords hardwired inside, has to be run as administrator, has some command injection problems, etc.? Sadly companies think of security as a cost and to maximize their profit, they let people who should never even approach a keyboard write insecure programs because they cost less. Because testing is also expensive, it's the same story. Did a big airplane manufacturer do the same? Their customers? Who makes the decision often doesn't care. They prefer to spend more money to purchase a scapegoat, or a "silver bullet" appliance, so that they can say, "Hey, we had all of the countermeasures, but hackers know black magic!". I don't want to burn out. I prefer to give the correct information to the people that want to listen and then hope for a better company in the future.

____

<comment><USER77> Thank you ! Yes it isn't my first language and I wrote the post going at work, on a bus. So no time to review it.

</comment></comment></comment><comment><USER79> I like that at least you have a plan to do next lol

</comment><comment><USER80> Sounds incredibly like LogRhythm to me :)

</comment><comment><USER81> beyondcorp : hardware keys and certificates for access to everything essentially

</comment><comment><USER82> Thanks OP for this

</comment><comment><USER83> Join a night college and acquire new skills;

</comment><comment><USER84> What you gonna do about it?

<comment><USER85> You mean the last three paragraphs titled "So what am I going to do about it?"?

</comment></comment><comment><USER86> You are not pissed off of your work. You are pissed off of yourself. You are not complaining because the work is wrong, you are complaining because you are angry within, and you believe it is not your fault. You are not taking responsibility of your emotions as you are supposed to and as taught by all the masters of wisdoms. Go back home and rethink who you are. The world is not changing for you unless you change yourself. You are losses off because you are seeing an imperfect self everywhere .

<comment><USER87> This type of drum circle commentary is so unhelpful.

Raising the bar for security in the software industry requires much more than just self reflection and elbow grease from individual engineers.

The solution requires buy in from all stakeholders. Especially management.

<comment><USER86> We are not talking about the same problem. Yo are not seeing the fact that it is only you who are responsible for what's happening inside you . And you are taking the wrong path fixing that by fixing everything else but you.

<comment><USER49> "Yo are not seeing the fact that it is only you who are responsible for what's happening inside you ."

This kind of pop-psych babble is naive and abusive.

<comment><USER86> Blame the whole world, why don't ya

<comment><USER49> That's clearly the only other option.</comment></comment></comment></comment></comment></comment>