Towards an ImageNet Moment for Speech-to-Text - <AUTHOR> https://thegradient.pub/towards-an-imagenet-moment-for-speech-to-text/ <comment><USER2> One interesting point: "1,000 hours is also a good start, but given the generalization gap (discussed below) you need around 10,000 hours of data in different domains."

Many of the companies working in this space who aren't Google/Amazon target less general domains, using domain-specific languages models to skirt around the lack of annotated acoustic data. But the lack of annotated acoustic data is a real problem, so any effort to provide data to everyone (particularly for a non-English language) is extremely admirable. I applaud the OpenSTT team for their work.

<comment><USER3> Yeah we have an automated payment system at work with amazon. I helped prototype it and an intern which we hired finished it. People use it all the time and the intern has less errors then my code.

</comment></comment><comment><USER4> The author wrote a follow-up article as well: [https://thegradient.pub/a-speech-to-text-practitioners- criti...](https://thegradient.pub/a-speech-to-text-practitioners-criticisms- of-industry-and-academia/)

<comment><USER5> And a corresponding HN thread here: [https://news.ycombinator.com/item?id=22790188](https://news.ycombinator.com/item?id=22790188)

</comment></comment><comment><USER6> TLDR, this is about an effort to collect a new large dataset for speech-to- text and an exploration of model design choices to enable programmers without huge computational resources to work in the space (it mostly does not touch on fine-tuning so 'ImageNet moment' is a bit overclaiming, but then again it does say 'Towards').

I found the "Why not share this in an academic paper" part interesting (and I expect it to be interesting to HN). As more practitioners enter the field, a lot of empirical knowledge will be gained but will be tricky to share since they will likely not know the convention of academic writing, Latex, etc. (to be clear, I think when done well papers are a good format to share information). Perhaps stuff like this and distill.pub will become more common? Seems like a good development IMO (as is researchers writing blog posts in addition to papers).

</comment><comment><USER7> I don't get the claim about lack of training data.

Most TV stations broadcast with closed captioning and most movies have subtitles available, which should give millions of hours of training data.

It's technically copyrighted, but as long as you don't distribute the video as well, they aren't going to care about it.

Also the complaint that the data lacks compression artifacts is completely ridiculous and absurd: if you want compression artifacts, just compress and decompress the speech yourself!

You can also pay people to transcribe audio or read text (or even do it personally), and since this is something anyone can do it can be paid at very low rates.

<comment><USER8> There's lots of resources for English and much less for many other languages - this article is about the non-English case.

Closed captioning and subtitles are often used, but they are 'dirty data' \- they are usually not a one-to-one match, the differences mess up training. And licensing issues are a pain; "they aren't going to care about it" is not a solution and things like background music in movies (the rightholders very much _do_ care about it, even if just to make a point) make it pretty much impossible for e.g. some university to legally distribute a dataset that includes movie audio tracks; so they can run some experiments on it themselves but as soon as you want any collaboration, that data is taboo.

Paying people to transcribe or read works, but it's not cheap. Reading 10000 hours takes at least 10000 hours of paid work and generally a bit more than that - mistakes matter, so you need review and correction. If you try transcribing things yourself, a tiny 100 hour dataset is going to take you at least something like 400 hours, which is months of work.

So that's the point - getting a usable dataset for some language costs hundreds of thousands of dollars if you're frugal, and millions if you want good results. And there are very many languages in the world.

</comment></comment><comment><USER9> Heres a Project which is usable for speech to text via API and docker image:

[https://github.com/gooofy/zamia- speech#download](https://github.com/gooofy/zamia-speech#download)

[https://github.com/mpuels/docker-py-kaldi-asr-and- model](https://github.com/mpuels/docker-py-kaldi-asr-and-model)

(also supporting german language pretty good but not production ready)

</comment><comment><USER5> Great writeup! I like the detail, especially in Making a Great Speech To Text Model.

It looks like their research is against an older wav2letter model (likely the conv_glu model from the original 2018 Gated ConvNet paper). Facebook has released a lot of interesting architectures since then, my favorite of which is the Streaming ConvNet arch [1]

Ideas from the post compared to my experience with wav2letter:

1\. Model Stride - increased model stride to 8x

Streaming ConvNet increased the stride to 8, while the original conv_glu model had stride 2 (cite: [2]), so Facebook agrees on this one.

2\. Compact Regularized Networks - use separable convolutions, add skip connections, and attention modules

Streaming ConvNets use Time-Depth Separable Convolutions, but no skip connections or attention. Facebook's "state of the art 2019" research tried a lot of architectures, the most accurate of which was a transformer model trained with attention and seq2seq criterion. However in my experience it was very large and slow to train.

3\. Using Byte-Pair Encoding

Streaming ConvNets model uses 10,000 word pieces, which is a similar thought (the token set FB uses is here: [4] but I've had better luck with a sentencepiece model trained on more text data) instead of a ~26 letter alphabet from the original conv_glu model.

4\. Better Encoder

The blog post conclusion here isn't very obvious, it seems to hand wave that you could maybe use a transformer architecture but doesn't go into specifics.

5\. Balance Capacity

I don't completely understand what they changed here but it seems useful.

6\. Stabilize the Training in Different Domains, Balance Generalization

When adding domains to wav2letter, I've basically trained entirely from scratch using all available data. I long for a catastrophic forgetting mitigation like EWC but for now I've had a lot of success by just making the data funnel bigger and more varied. Data matters quite a bit, in this post [5] I compare a model I trained on a wide variety of data, with Facebook's equivalent model as well as Facebook's State Of The Art model. The wide- variety model generalized significantly better than both of Facebook's examples that had only trained on audiobooks.

7\. Make a very fast decoder.

The beam search decoder in this branch [6] of Talon's wav2letter fork was at the time significantly faster than Facebook's decoder. It was hand optimized and even includes some code for threaded decoding (which I'm not using at the moment because single threaded is fast enough for my workload). On single threaded decoding it can hit a realtime factor in the ballpark of 0.01x, or 100 seconds of audio per cpu second. With my smallest model (a significantly reduced size conv_glu wav2letter model), which is also in the 0.01x ballpark for encoding, we can consistently hit around 0.02x end to end on a consumer CPU.

To demonstrate, here is a random sample of debug timing information from my machine when recently decoding command phrases with wav2letter during real interactive use (the very long audio samples aren't the model's fault, I was testing a mic in a noisy environment):

        [audio]=1260.000ms  [emit]=16.164ms (0.01x)  [decode]=11.326ms (0.01x)  [total]=27.490ms (0.02x)
        [audio]=1260.000ms  [emit]=16.164ms (0.01x)  [decode]=11.326ms (0.01x)  [total]=27.490ms (0.02x)
        [audio]=930.000ms  [emit]=12.853ms (0.01x)  [decode]=3.716ms (0.00x)  [total]=16.569ms (0.02x)
        [audio]=1080.000ms  [emit]=14.936ms (0.01x)  [decode]=3.296ms (0.00x)  [total]=18.231ms (0.02x)
        [audio]=1020.000ms  [emit]=12.976ms (0.01x)  [decode]=10.058ms (0.01x)  [total]=23.034ms (0.02x)
        [audio]=930.000ms  [emit]=13.836ms (0.01x)  [decode]=9.998ms (0.01x)  [total]=23.834ms (0.03x)
        [audio]=1140.000ms  [emit]=14.535ms (0.01x)  [decode]=3.589ms (0.00x)  [total]=18.124ms (0.02x)
        [audio]=1650.000ms  [emit]=20.516ms (0.01x)  [decode]=5.281ms (0.00x)  [total]=25.797ms (0.02x)
        [audio]=3480.000ms  [emit]=31.386ms (0.01x)  [decode]=32.966ms (0.01x)  [total]=64.352ms (0.02x)
        [audio]=29760.000ms  [emit]=253.671ms (0.01x)  [decode]=325.198ms (0.01x)  [total]=578.869ms (0.02x)
        [audio]=8850.000ms  [emit]=70.844ms (0.01x)  [decode]=76.267ms (0.01x)  [total]=147.111ms (0.02x)
        [audio]=960.000ms  [emit]=13.924ms (0.01x)  [decode]=8.135ms (0.01x)  [total]=22.060ms (0.02x)
        [audio]=1770.000ms  [emit]=19.760ms (0.01x)  [decode]=18.612ms (0.01x)  [total]=38.372ms (0.02x)
        [audio]=930.000ms  [emit]=12.488ms (0.01x)  [decode]=6.842ms (0.01x)  [total]=19.330ms (0.02x)
        [audio]=1050.000ms  [emit]=15.726ms (0.01x)  [decode]=7.645ms (0.01x)  [total]=23.371ms (0.02x)
        [audio]=930.000ms  [emit]=13.899ms (0.01x)  [decode]=8.714ms (0.01x)  [total]=22.613ms (0.02x)
        [audio]=40410.000ms  [emit]=292.916ms (0.01x)  [decode]=289.109ms (0.01x)  [total]=582.025ms (0.01x)

[1] [https://github.com/facebookresearch/wav2letter/tree/master/r...](https://github.com/facebookresearch/wav2letter/tree/master/recipes/models/streaming_convnets)

[2] [https://github.com/facebookresearch/wav2letter/issues/543#is...](https://github.com/facebookresearch/wav2letter/issues/543#issuecomment-588062135)

[3] [https://github.com/facebookresearch/wav2letter/tree/master/r...](https://github.com/facebookresearch/wav2letter/tree/master/recipes/models/sota/2019)

[4] [https://dl.fbaipublicfiles.com/wav2letter/streaming_convnets...](https://dl.fbaipublicfiles.com/wav2letter/streaming_convnets/librispeech/librispeech- train-all-unigram-10000.tokens)

[5] [https://github.com/facebookresearch/wav2letter/issues/577](https://github.com/facebookresearch/wav2letter/issues/577)

[6] [https://github.com/talonvoice/wav2letter/tree/decoder](https://github.com/talonvoice/wav2letter/tree/decoder)</comment>


"The street finds its own uses for things" (2012) - <AUTHOR> http://citiesandcitizenship.blogspot.com/2012/03/street-finds-its-own-uses-for-things.html?m=1 <comment><USER2> Does anyone have any tales of 'street uses' they have come across of some more recent technologies?

I often feel like the technologies people get excited about around here are too tied to their designed uses, but maybe that's a lack of ingenuity or perspective on my part.

<comment><USER3> \- Bitcoin, Tor for drugs/illicit purposes

\- Tumblr as a social media space instead of a Blogger-type platform (the original intended use case)

<comment><USER4> Social media and Bluetooth played a role in the Arab Spring [1]. Your average spy movie or series (I am currently watching The Americans) contains loads of [fictional] examples. Some other examples: SSH over Tor to get around firewall(s). USB sticks in concrete as a means of a drop point.

And what is fiction, might become reality. Just a matter of how far you wanna look. Snow Crash pretty much described Second Life or MMOs with the Metaverse. Plus, I remember around 2000 a joke IIRC called the iBrator. It was a remote, internet controlled vibrator. Back then it was an April Fool. Look where we are now? You can pay to make a person's (most likely a woman) vibrator vibrate, live, over the internet. You can call that an unintended consequence of the internet, USB, video conferencing, javascript, or what not.

[1] [https://en.wikipedia.org/wiki/Arab_Spring](https://en.wikipedia.org/wiki/Arab_Spring)</comment></comment></comment>


Skin in the Game as a Required Heuristic for Acting Under Uncertainty - <AUTHOR> http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2298292 <comment><USER2> I wrote a blog article about requiring skin-in-the-game the other day. My food for thought is:

Small transactional costs stop things from existing at the fetal/growth stage. Evolution destroys them long before the long-term benefits demonstrate themselves as it supports short-term adaptive traits over long-term adaptive traits. If you require skin-in-the-game transactional costs then your transactions will happen far less often, and in the short-term you will get out-competed for resources by those that protect themselves with top-down regulations.

It is often difficult for third-parties to evaluate the authenticity of a cost or regulation, which is why institutional costs exist - they factor out hundreds of checks of hundreds of transactions into a single check of the institution that regulates hundreds of transactions (which itself is often proxied by the social proofing of this institution.) This lowers the transaction cost which causes high growth.

Fetal is really a good analogy here. The womb exists for good reason; scaffolds exist for good reason; decorum on first dates exists for good reason. Without these things early transactional costs defeat growth.

In short, skin-in-the-game evolves out of artificial systems as it is bad for early-growth. However this does not mean that it should; in well- designed/natural systems the entity first exists in a protective bubble during its gestation period and then slowly has its skin placed in the game.

<comment><USER3> I don't think your analogies apply. We do not demand that a fetus bear the cost of its bad decisions, because it is incapable of making decisions. (But we might start exposing a child to consequences of its bad actions, in proportion, quite early.)

Similarly, a building under construction is incapable of advising someone to buy stocks. And first dates do not usually result in land wars in Afghanistan.

Can you give an example of a process or profession which can be said to willfully expose others to risk, which _does_ deserve this sort of protection when it's just starting out? It seems to me that such responsibilities are nearly the definition of maturity.

<comment><USER4> >And first dates do not usually result in land wars in Afghanistan.

Keyword: usually.

<comment><USER5> Goddamn butterflies

</comment></comment></comment></comment><comment><USER6> It doesn't mention any negatives of requiring skin in the game. The most obvious is adverse selection: risk-averse people won't enter a profession where mistakes are severely punished, so you get only risk-seekers.

<comment><USER7> It's kinda interesting that the modern corporation was explicitly designed to _shield_ the decision-makers from risk. Without it, many of the large industrial & trade breakthroughs of the enlightenment wouldn't have been possible, as nobody would've been willing to take the personal risk of venturing to the Indies or setting up a cotton mill when the downside of failure was perpetual indentured servitude.

I don't think it's bad to require some skin in the game, but require too much and many risks that are quite beneficial to society as a whole just won't happen.

<comment><USER8> Partially disagree. The original necessity of corporations was to _distribute_ risk, not to _remove_ it. There was the same total risk, but born across a wider number of people. The financial risk was unchanged, but the consequences were made less catastrophic. Equivalently, a corporation aggregates enough resources for the risk to become rational.

By contrast, one of the functions of modern corporations is that culpability does not pass-through to the decision-makers. This is an actual removal of risk, not re-distribution, as there are consequences that a corporation is not capable of facing.

<comment><USER9> I was thinking about this the other day. Just as with joint-stock ownership, legally limiting financial liability redistributes risk (by transferring it to creditors), but doesn't reduce it in net.

Creditors tend to be established firms and bankrupt companies tend to be new, small enterprises, so it seems that limited liability promotes socially beneficial risk-taking by offloading bad outcomes on those who are best able to absorb them. ... "From each according to his ability, ..."

</comment></comment></comment></comment><comment><USER10> It's not immediately obvious there's anything new or interesting in there: how is this heuristic different to a classic Hansonian bet [1]?

One potential advantage is that having "skin in the game" has a more positive connotation than betting on outcomes, to the general public at least. Regardless, Hanson at least deserves a mention.

From a stylistic point of view I'm not a big fan of the appeals to authority (e.g., "the ancients were fully aware" ) either.

From a startup perspective it's worth mentioning that mentorship or advice is also generally more confusing and less useful when the mentor lacks "skin in the game". Hence mentor "whiplash".

[1] [http://www.overcomingbias.com/2013/07/bets- argue.html](http://www.overcomingbias.com/2013/07/bets-argue.html)

<comment><USER11> Good points. However, I don't think that "the ancients were fully aware" is an appeal to authority. I think the idea is ancient people tended to use things that were successful; therefore if the ancients used something, we should boost our confidence in it (relative to the baseline).

<comment><USER10> You're partially correct. I'd say that we tend to adopt the successful cultural adaptations of our ancestors and discard the others.

In other words, when comparing an ancient society to one descended from it, I'd expect the "successful" adaptations of the ancestor culture to be disproportionately present in the descendant. The converse need not be true.

In Taleb's example Taleb of the builder, those ancient heuristics became our tort law (and will be a part of our reputation networks in the future). He doesn't mention all the cultural adaptations we've since dropped...

So it's obvious at best, and an appeal to authority at worst.

</comment></comment></comment><comment><USER12> The comments here seem to miss Taleb's central idea that harm is non-binary. You need to consider not just whether something occurs, but how much impact it has.

I don't care whether a bank earns a financial gain or a loss. I care how big the gain or loss is. One hundred years of small profits can be wiped out in one bad quarter.

I do not believe Taleb is proposing punishing all risk taking. He's advocated aggressively taking risks where the downside is known.

The problem we face is that many are now in a position to get a limited, positive upside if things go well, but they face no downside. And the potential harm in such situations has no upper bound.

Skin in the game ought to be proportional to harm. Many comments mention medicine as a profession that should not have skin in the game.

Rubbish. Doctors are very liable if things go wrong. But it depends how wrong. We don't hold doctors accountable for small errors, or random errors.

We hold them accountable for big errors. The bigger the error, the worse the punishment.

<comment><USER13> There's an issue in convincing people that harm is completely continuous. If there is a perception that there is some culpability in performing some action, regardless of how small, then it is easy to exaggerate it to a significant quantity in their mind. This would make society increasingly hostile and litigious for even small gestures like offering to watch their stuff while they visit the restroom.

</comment></comment><comment><USER14> Such a simple heuristic, but I think with far-reaching consequences. Last week, NNT posted a link to a news article with talked about a new law in an Indian state that required headmasters to taste the food that was served in the school cafeteria. This was initiated after a bad case of contaminated food and deaths resulting from it.

</comment><comment><USER15> I gave the paper a quick skim. My thoughts:

As they point out in the paper, there are some cases where risk is intentionally removed, such as through bankruptcy for businesses to protect entrepreneurs. I think that can have positive effects.

I'm not fully convinced that "academic economists, quantitative modellers, and policy wonks"..."have no disincentive and are never penalized by their errors." I believe their reputation is at stake. The authors may mean they have no financial risk, but their reputation is tied to their future earnings. I'm not sure that's a bad thing as long as it's considered.

Overall I'd say there's nothing surprising in this paper, nor any specific proposals (as I hoped) but mostly a philosophical argument made in reaction to the current financial and political environment. I do agree with their premise. As a political view, I think "Skin in the Game" would make a pretty good slogan.

It would be interesting to implement distributed trust networks around this concept. If there are clear failure/success signals, you could have nodes present a bond which is destroyed on success and paid out on failure. Automated damages collection, I suppose.

<comment><USER12> His point is that there's rarely a reputational hit for being wrong in those professions. There should be, but there isn't.

Examples:

Thomas Friedman supported the Iraq war. [http://www.youtube.com/watch?v=ZwFaSpca_3Q](http://www.youtube.com/watch?v=ZwFaSpca_3Q)

Joseph Stiglitze and Peter Orzag predicted Fannie Mae and Freddie Mac faced near zero risk.

Stiglitz later claimed credit for predicting the financial crisis(!) and Orzag had a prominent position in Obama's administration

[http://www.pierrelemieux.org/stiglitzrisk.pdf](http://www.pierrelemieux.org/stiglitzrisk.pdf)

What commentator can you think of that's lost his job for a bad prediction?

Pundit's have perverse incentives. They can point to correct predictions to boost their career, and they are penalized very little for wrong ones.

They have an incentive to make many predictions, and retrospectively choose to highlight only those that panned out.

<comment><USER16> To be fair, Fannie Mae changed its practices, engaging in the risky "financial innovations" that caused problems for a lot financial institutions, after Stiglitz' original study of their exposure to risk.

It is not as if Stiglitz was in control of the institution or encouraged that they engage in these more risky behaviors.

It is more like a doctor performing a check-up on a patient, which represents a mere snapshot in time, saying they're in good health. And then the patient decides it's okay to start smoking, eating fastfood for every meal, and giving up exercise. Are you going to blame the doctor for not warning this could happen?

I would say the stronger lesson is that continued checks and oversight are critical to the health of any institution or business. Though I do also agree and think people who make sloppy predictions should also be held accountable for their behavior.

</comment></comment></comment><comment><USER17> Interesting read. I liked the reference to Ralph Nadar... Those who vote in favor of war should be required to enlist in a draft.

Though I don't know how serious I can take this when the guy uses the word 'wonks' in reference to those he disagrees with.

Also I think that the lack of 'skin in the game' encourages risk, which counteracts a natural tendency for large groups to be more conservative (look at big business vs small). If you made decision makers have skin in the game, you'd have even less innovation and new ideas in large institutions. This is taking into account factors beyond his thesis, but leads to interesting thoughts when it comes to practical application of his ideas.

<comment><USER18> I could be wrong, but I believe the term "policy wonk" is not necessarily negative... I assumed it simply referred to one who is well-versed in policy debates and data.

For example: [http://www.washingtonpost.com/blogs/wonkblog/](http://www.washingtonpost.com/blogs/wonkblog/)

<comment><USER12> This is correct.

source: extensive reading of political blogs + newspapers circa 2006-2008.

</comment></comment></comment><comment><USER19> _the skin in the game heuristic relates directly to the virtue of being such that the system will not only survive uncertainty, randomness, and volatility but will actually benefit from it._

Doesn't Taleb mean that the 'skin in the game' heuristic will prevent uncertainty, randomness and volatility in the system rather than bring benefit? Within examples such as the 07-08 financial crisis, which he must be referring to indirectly, 'skin in the game' would have meant less risk-taking, therefore reducing volatility. But I can't see how the system would have actually benefited from volatility.

<comment><USER20> Taleb defines a system as "anti-fragile" if it benefits from volatility. His previous works build up a mathematical framework for distinguishing between things which are harmed by fragility, things which are neutral to fragility, and things which are benefitted from fragility, which are fragile, robust, and anti-fragile, respectively.

<comment><USER21> What's so mathematical about it? It has lots of pretty graphs and charts, but as far I could tell, it's just philosophy masquerading as mathematics.

</comment></comment></comment><comment><USER22> I haven't read the paper yet but I remember reading someplace that the fundamental of economics is that if you introduce costs into a system, you should bear them.

</comment><comment><USER23> So what happens to the authors of this paper if we take their advice and it goes badly?

<comment><USER24> Nothing of course! It's one of the wonders of being an economist ;)

(sarcasm aside, I do think there should be stronger professional repercussions in economics for advocating idiotic policies. It's one thing to found a startup and fail, and then start again; it's another to cause a deep recession in a country and then say "oh well, let's try again")

</comment></comment><comment><USER25> Nothing educates you like an actual personal loss. If its always other people's money, people will figure out how to game it. And those okay with gaming it will soon crowd out the rest, as they can work for less because they get paid extra for gaming it.

If the banks writing bum mortgages had to take the loss instead selling all the losers to Fannie and Freddie, many bum loans would have never been made.

</comment><comment><USER26> Does this really solve the problem?

The execs at Lehman and Bear had skin in the game. Sure some of the senior- most folks got away with small fortunes, but everyone last money. Some people lost their life savings.

Conceptually this makes sense (similar to requiring all derivatives trades to have margin requirements to limit leverage) but does it really fix what went wrong?

</comment><comment><USER27> My favorite example of skin in the game is riding a bicycle.

Compared to driving a car with a ton of metal and five airbags around you, riding a bike means that you literally have skin in the game.

On the other hand driving a car you basically have no skin in the game. You jump a red light or drive too fast and as long as the cops don't catch you it's alright.

</comment><comment><USER28> In some sense, the same ideas he has always written about, but again expressed in a new way. I like it.

</comment><comment><USER29> Investors need to act as if they could stomach a total loss on the investment, founders need to act as if they can't survive failure on the venture.

Now imagine that these two roles usually exist in the same person, to varying degree.

</comment><comment><USER30> This is why I believe more in devops approach. When ops and dev are separate it's both developers acting in an environment with little useful feedback and ops always able to blame developers.

</comment><comment><USER31> I'm re-watching The Wire at the moment, which I'm enjoying greatly, and one of the best things about it is watching the lengths that the characters go to in order to avoid being personally linked with criminal operations under their control. They benefit when the organization benefits, but aim to avoid the downsides when their staff's activities are exposed.

As long as there are areas with very high reward (investment banking, drug dealing, human trafficking, startups), and enterprising individuals with the connections to organize them (either through experience and leadership progression, or by using opportunities to undermine former leaders / acquire resources), people will rise to these opportunities.

Once an operation reaches a certain size however, many leaders become disconnected - intentionally or otherwise - from the day-to-day business of their organization.

Given the typical attitudes on HN, I'd expect that most founders here would be genuinely mortified to find out if their software had caused real-life problems - most would take a lot of care to ensure good user experience and correct results; these make good business sense too. However I think many would eventually aim to become distanced from the business too - the dream of reliable passive income.

Meanwhile, we imagine - and it's not hard to imagine - that many bank executives, criminal leaders, and others - actively enjoy their life in distance and immunity while feeling little remorse for the damage they do, and certainly not taking any intrinsic risk for it.

We expect that the rule of law will deal with these problems when they occur - that's what optimistic films and positive fiction tell us - but the reality is that a good-enough combination of wealth, influence, leverage over others, and wits can let people stay at arms-length from (but in control of) nefarious affairs even if they _are_ aware that they are causing harm.

In some ways I think this expresses itself even in the trend for honest businesses to avoid liability where possible -- if we take liability for what we do, we also have to do the best we can and take genuine care of our customers.

Somehow a fear of litigation, genuine exploitation of litigation (c.f. ambulance-chasers), and fear of decreased business efficiency have reached the level where companies _do_ prefer to distance themselves. Often it is via lacklustre or even laughable attempts, such as using oft-ignored in-store signage, disclaimers, or automated customer interactions.

Retreating from each other for fear of risk isn't healthy as a general trend, and neither is our inability to reach and re-integrate those who expressly _intend_ to maintain their distance to avoid risk to themselves.</comment>


Blood-Testing Firm Theranos to Dissolve - <AUTHOR> https://www.wsj.com/articles/blood-testing-firm-theranos-to-dissolve-1536115130 <comment><USER2> Highly enjoyed _Bad Blood_ and recommend it to anyone interested in some fine investigative journalism.

I think the most disappointing thing about this whole saga is that (in theory) the Theranos technology was supposed to be a major healthcare game changer. It could have revolutionized testing, and would surely have saved countless lives.

But instead... here we are.

<comment><USER3> > think the most disappointing thing about this whole saga is that (in theory) > the Theranos technology was supposed to be a major healthcare game changer. > It could have revolutionized testing, and would surely have saved countless > lives.

This reads like such a weird statement. It never existed. It could've never have revolutionized testing because it was entirely imagined and not based on reality.

It's like watching Star Trek thinking tricorders are real then being disappointed when told they're a fiction.

<comment><USER4> So, I'm one of Theranos' biggest critic, since I've had a weird fascination with the company since someone on HN pointed out the bizarreness of its BoD back in 2013.

I think if Theranos hadn't gone all-in on its fraud it still could have had an impact. One area was that it was actually pushing to change laws (I know it did this in Arizona) to give individual control over blood testing instead of requiring people to go through doctors and corporations. Another area was price transparency. Much like the Surgery Center of Oklahoma ([https://surgerycenterok.com](https://surgerycenterok.com)), it was listing all the prices for its tests right there on its website. These 2 things alone would be a major advancement in the US. Forget the mini blood tubes.

<comment><USER5> The law change for direct access to lab ordering and results is really independent of Theranos. HHS changes rules in 2014 to allow patient access [0] that goes back almost 20 years.

The price listing was pretty cool though.

[0] [http://www.labtestingmatters.org/direct-access-to-test- resul...](http://www.labtestingmatters.org/direct-access-to-test-results/)

<comment><USER6> It's also not clear that it's a good thing; false positives lead to serious negative consequences which is why tests aren't ordered in the first place. It's why you don't get a colonoscopy at 25: chance_of_false_positive * harm_of_false_positive > chance_of_detection * treatment_success until much later in life. You as an individual are not qualified to make that aggregate decision.

</comment></comment></comment></comment></comment><comment><USER7> The one thing I am very surprised so few people bring up is that finger sticks hurt like heck compared to a venous puncture. I give blood all the time, so much that I have scars from giving blood (and donating plasma in my youth). The only thing about giving blood that hurts is that darn finger prick to check your hematocrit. Sometimes I can't type the whole rest of the day. I would never choose a finger prick over a regular sample.

<comment><USER8> Your experience is not mine, and I'm not sure it generalizes.

<comment><USER9> In my experience, getting shots or blood draws does not hurt. A finger prick might or might not. But I'd prefer the finger prick anyway because it's much less creepy than having a long needle stuck into your vein.

Antivaccination movements historically pop up in all kinds of different places and contexts for different nominal reasons, and I'm pretty sure a big part of what gives them steam is that people just aren't comfortable with the physical logistics.

<comment><USER10> Interesting. I'd echo the original commenters sentiment. I have given blood a few times and was never really bothered about the long needle sticking in my arm, nor the process in which it got there, but the two times or so where I got the finger prick for a small amount of blood were a painful and inconvenient experience.

<comment><USER11> Finger pricking and typing don't go well together. One is a really annoying experience. One is like, "ooooh that didn't hurt as much as I expected"

</comment></comment></comment></comment></comment><comment><USER12> It is hard to remember a time when Theranos wasn't a byword for scamming, but if you have 15 minutes it's worth searching HN for Theranos articles and look at comments from the very beginning.

<comment><USER13> Here's two examples:

[https://news.ycombinator.com/item?id=7951019](https://news.ycombinator.com/item?id=7951019)

[https://news.ycombinator.com/item?id=6349349](https://news.ycombinator.com/item?id=6349349)

<comment><USER14> It seems from those comments there that a lot of people on here were quite sceptical to their methods from the start.

There are a lump of people who appear excited in general, sure, but the people who appear to have know-how in the area are more subdued and questioning, even then. There are a fair few comments calling it garbage.

Many people seem to have called it.

<comment><USER15> "It seems from those comments there that a lot of people on here were quite sceptical to their methods from the start."

This is no different for literally every HN post.

<comment><USER16> It's cynicism, but that's hard not to contract these days. If you've been around the Internet long enough and know something about anything even remotely scientific or technical, you quickly learn that:

\- You can't trust scientific press releases at face value.

\- You definitely can't trust science reporting in media, or any kind of reporting for that fact (see: [https://en.wikipedia.org/wiki/Gell- Mann_amnesia_effect](https://en.wikipedia.org/wiki/Gell-Mann_amnesia_effect)).

\- You can't trust companies not to oversell themselves, in particular startups like this, you never take them at face value.

People are much less cynical when a company is open about what it's going to do and how, talking science and engineering instead of marketing & PR bullshit.

</comment></comment></comment></comment></comment><comment><USER17> Bad Blood is an awesome book. Really disturbing. There's a story about a naive stanford grad who joined Theranos and tried to blow a whistle internally when he realized that the "Edison" (a Theranos-based testing equipment) was BS. Holme's right-hand-man destroyed the kid, fired him, and even turned his grandfather against him (who was an investor - these Stanford fucktards and their legacies). Of course that stanford person is now pursuing his own startup...

Bad Blood has not had the impact in SV that it should have. The stock market needs to crash and the myth of steve jobs needs to die :-(

<comment><USER18> > The stock market needs to crash and the myth of steve jobs needs to die

It's not all about myths. The interest rates are still very low especially for the rate of growth. Decent returns are hard to find and people are willing to chase just about anything. Ofc, her decision to copy alot of Jobs' style made for some easy pickings.

</comment></comment><comment> a-dub In seriousness, internet business culture makes everything look easy. Internet things have outsized impact due to the global reach of a revolution in communications technology. Smartphone things have outsized impact due to good UX finally reaching the masses when they were ready for it.

I think the lesson here is that doing anything that interfaces directly with the physical and natural world is much harder, and those problems that have high impact have had a lot of very smart people working on them for a very long time.

It's easy to think that the formula for internet media or smartphone IT success can easily translate to these domains, and it seems that the reality is "no, it doesn't.". There is no low hanging fruit on the hard problems, as there was with the internet and smartphone revolutions.

<comment><USER19> I like your approach but I disagree with your conclusion. Just recently Pepsi Co bought SodaStream for $3.2B. AFAIK, SodaStream is essentially a company that innovated with the UX outside the Internet-based technologies, not solving some hard problems.

Theranos claimed to have been doing something similar but failed due to their choice of UX improvement approach being based on technology that does not work.

An analogy in the internet-based business would be promising to improve the UX of customer support using AI and then not delivering on the AI part.

I think that your "Outsized impact" concept is interesting but I think that there is no such thing, it's just an illusion due to the speed differences of the delivery of the impact. Should Theranos was not based on pseudo-science, the eventual impact could have been no smaller than your average internet unicorn.

<comment> a-dub tldr;

internet/smartphone success comes from low hanging fruit made possible by revolutions in communication technology. it does not translate to hard domains like biomedical science. these problems are legitimately hard. and quite orthogonal to soda and chatbots.

<comment><USER19> Theranos' was not about making something previously impossible, possible.

Theranos doesn't have anything to do with biomedical science, they were supposed to improve the experience of blood testing both for the patient and for the medical professionals. Their problem was that they choose to try to do it by a method that was not technically possible at this time.

Another company might try to improve the experience by improving the needles and redesign the machine to look like less offensive and scary and they might succeed in it.

It's exactly like the difference between SodaStream's success and chatbots failure, that is, betting on UX improvement using a tech that's not there.

Chatbots, SodaStream. Theranos - they don't do anything new that wasn't done before. Chatting with customer support was around since a while, Carbonating water to make soda was around since probably the industrial revolution and testing blood samples were around since modern medicine.

All these companies tried to improve the experience and reduce costs, regardless of the nature of the business being internet or manufacturing based. It's not about the domain.

EDIT: I'm not defending Theanos and I'm not going to comment about the motive of the people involved as I don't know them and I was not involved with Theanos at any time.

<comment><USER20> > All these companies tried to improve the experience and reduce costs, > regardless of the nature of the business being internet or manufacturing > based.

No, Theranos did not do that. They _claimed_ that's what they were trying to do, but they were, in reality, _marketing a fraudulent product that did not work_.

This is very simple. It is also a very important distinction, and it's worrying that many people here seem not to get it. This is not a "they tried and failed with the best of intentions" situation. This is not a typical failed-startup situation. This is not a product-market-fit issue.

This is a company that claimed to be improving the state of the art but was actually engaging in a deliberate deception.

You don't have to know the "motive of the people involved" to understand that Theranos' situation is _fundamentally ethically different_ from that of a well-intentioned company that was unable to deliver on its promises. This isn't a difference in degree (of money involved or people defrauded or whatever), it is a qualitative difference. It's deeply disturbing to me that yourself and many others seem unable to see that.

<comment><USER19> I don't know about the details of the case so I'm trying not to claim that somebody did something in bad faith. I find internet lynches distasteful.

Did an actual investigation found out that these people scammed the investors?

What was their end game? Live a life of fame for a few years until people start asking questions and end up broke and labelled as frauds for the rest of their lives?

</comment></comment></comment></comment></comment></comment><comment><USER21> I just finished Bad Blood and one thing I have noticed is that how much you can get away with if you have mastered the art of talking to powerful people. It seems they could have figured out much earlier that Theranos was a fraud if anybody had ever bothered to take a closer look. Even when some people started having doubts Holmes always was able to take herself out of it. Instead the whistleblowers got treated badly. The Shultz situation was especially frustrating to read.

This reminds me a little of a situation at work. We have a director who everybody outside management knows he is full of sh.t. He never delivers anything and when you get the chance to talk to VP or CEO they agree that he needs to go. But then they talk to him and he always gets a second chance. This guy gets much more face time with our CEO then anybody else I know.

</comment><comment><USER22> I really, really wanted their tech to be real. It could have been transformative. I've seen a lot of glee over their (well deserved) failure, but I'd much rather be celebrating their success.

</comment><comment><USER23> Did anyone ever follow that $100 million a hedge fund dumped into the company like a year ago, well into the crap htting the fan? What was that about? Why would you do that?

<comment><USER24> It was for their patents - as one of the other commenters mentioned, in the event that they fold, i.e. now, the hedge fund gains ownership of all their patents.

<comment><USER23> Did they hold any valuable patents? As I understand the FDA came out and said the device didn't work and beyond that any evidence suggesting it did was not just misguided but fraudulent.

</comment></comment></comment><comment><USER25> They basically sold the patents their investors paid for when they took out the last loan and didn't meet the requirements to keep getting funded.

It seems that the only question remaining is how long Elizabeth and Sunny go to prison for after this brazen heist they pulled off.

<comment><USER26> Well, white collar crimes are not punishable offense.

<comment><USER8> If you have some legal insight, I'm sure the Manafort team would love to hear from you.

<comment><USER27> While GP's comment is somewhat tongue-in-cheek, the Manafort conviction is so newsworthy because it is such a rarity that white-collar criminals get prosecuted to this extent. It's the exception that proves the rule. Keep in mind, after the 2008 global financial crisis, in which several prominent financial institutions failed and millions of people lost their homes to foreclosure, only one banker was sentenced to jail time, and only for 30 months.

<comment><USER28> Why would you want to jail innocent people?

Sorry to be a devils advocate but past administration loosened up rules based on which you were or were not supposed to be eligible for a loan to an extent which it should never be.

Unless you want to jail George Bush or some of his staff members, there is not so much fault around to put on people working in financial sector.

<comment><USER29> I would love to jail George Bush and some of his staff members.

Interestingly, you have just implied that ultimately no one can be held accountable for these failures.

Isn't that a bit of a problem?

<comment><USER8> > you have just implied that ultimately no one can be held accountable for > these failures. Isn't that a bit of a problem?

Yes, but not one to be solved by retroactively classing behaviour that wasn't a crime then as a crime now. The right solution is to criminalize the behaviour moving forward.

</comment></comment></comment></comment></comment></comment></comment><comment><USER30> Fitting that this article is posted by John Carreyrou.

<comment><USER31> I guess it just makes sense for him to handle all of WSJ's Theranos coverage.

</comment></comment><comment><USER32> Serious question, even if the answer is fairly obvious; What does the future hold for Elizabeth?

I mean, how will a person who has done that and basically become a digital leper, recover or work again in any meaningful way? Change her name, learn a new language and move to another country?

<comment><USER33> Jail-time, surely? She has deceived investors. She's already not allowed to lead a company for the next 10 years.

<comment><USER34> > She has deceived investors

Maybe the investors deceived themselves. If I was investing millions of bucks in a startup run by a 19 year old I'd be doing a large amount of investigation. Doesn't seem like anyone did

<comment><USER33> How many investors _did not_ invest after they investigated? We'll never know. Theranos HR and legal dept. were fierce against any whistleblowers. One person even committed suicide because of the involved stress.

<comment><USER34> I had not heard that - very distressing

<comment><USER33> I read about it in Bad Blood, it was perhaps the most disturbing fact from the book. Especially given the suicide was in direct consequence of Theranos' scam, and also because I lost my uncle to suicide related to his work (which I suspect was related to ethics). There is a Wikipedia page devoted to the late Ian Gibbons [1] (I didn't verify the content of the entry though). I can highly recommend the book Bad Blood.

[1] [https://en.wikipedia.org/wiki/Ian_Gibbons_(biochemist)](https://en.wikipedia.org/wiki/Ian_Gibbons_\(biochemist\))

</comment></comment></comment></comment></comment></comment><comment><USER35> I hope I'm not becoming "that guy," but I feel like everyone is still missing the point on Theranos. Even if they hadn't defrauded investors, the company would never have had the impact they claim, because Theranos' entire finger- stick idea just doesn't fit into the lab industry.

I spent a bunch of years in labs, working for the tech companies that made the "state of the art machines" that did the actual testing. Theranos wasn't only competing with LabCorp and Quest, they were also competing with the testing machine companies like Beckman-Coulter, Roche, Siemens, Bio-Rad, and many others.

So many tests get ordered for a CMP (comprehensive metabolic panel, the most common battery of tests), that you would need like 30 finger sticks to get enough blood. Theranos never clarified if they could do 30 tests on 1 drop, or 1 test per drop. That little misdirect actually matters a lot to the patient who might have to get stuck 20+ times for all the things the doctor needs.

I'm quite familiar with the way the state of the art systems work. A modern system is already testing microliters of plasma (your blood goes through a centrifuge) per test. Comparing size of blood draws is misleading. The several tubes that get drawn are for logistical reasons that don't go away if you switch to finger-sticks. For example, the law requires that a lab keep some blood on hand for emergency re-testing if it turns out you have a critical level. Maybe a tech drops your sample. Maybe the machine has a problem right when it's doing your test (happens all the time, no reason it wouldn't happen with the Theranos instrument, had it existed). How many finger sticks are required to keep some extra on hand?

Theranos was also misleading about the test time, but that doesn't get mentioned either. They claimed 4-hour test time, but compared it to the 24-hour turn around time of a major lab like LabCorp. In reality, modern systems take 8-15 minutes for most tests, depending on what it is. Large molecules (hormones, etc) and whole-blood tests can take longer, sometimes up to 1.5 hours on older machines. Nothing approaching 4 hours, though. A 4 hours test time is atrociously long.

And after all that, you still need a doctor to look at the results. Let's say the dream happened, and we all started going to Walgreens to get Theranos tested. Even if we got 30+ tests on a single finger-stick drop, we'd still need to wait 24-72 hours for the doctor to look at the results and call us.

Maybe I'm beating a dead horse at this point, but I think from the very beginning, Theranos didn't have a serious business model. I also would like anyone on HN reading this, who's interested in the medlab space, to understand that there's a lot more going on than just testing on fingerpricks and fraud here.

If any of you out there actually _do_ have a revolutionary one-drop testing device, don't try to partner with Walgreens and open your own labs. Just sell/lease it directly to doctors and hospitals.

<comment><USER36> Could it have worked with standalone systems, running in hospitals, doctors' offices, etc? That would be impossible with current (or vaguely conceivable) technology, of course. Some years ago, I was seeing a doctor who did urinalysis in house. I figured that he was money grubbing, and maybe insurance companies eventually decided the same.

<comment><USER9> No, it could not have worked as desired with any system, because it is fundamentally impossible to use a drop of blood to detect chemicals which are present in the circulatory system from which it was drawn, but are not present in the specific drop being tested.

Blood is not a homogeneous substance. In order to be satisfied that you can detect substances that are present in the person, you need to extract more than a drop of blood.

<comment><USER27> To be more specific, most tests are designed around venous blood samples. Theranos' finger-prick would gather blood from capillaries in the finger, where the vessels are very narrow (changing the balance between blood cells and plasma) and also where diffusive processes into and out of cells are extremely active - and so assays like blood glucose level may be significantly off from what you would see in a venous draw, if for example your finger is curently burning a lot of energy ...

</comment></comment></comment></comment><comment><USER37> The big auction was on July 19. All the Mazaks are gone.

</comment><comment><USER38> I can't help but wonder if Theranos' tech really was that good and they got crushed by big medicine? It really doesn't seem all that far fetched to me.

</comment><comment> ryan-allen Paywall free link [http://archive.is/gEktW](http://archive.is/gEktW)

<comment><USER25> Outline is more optimized: [https://outline.com/kRrnNH](https://outline.com/kRrnNH)

<comment><USER39> The Outline is missing some of the text it looks like? The text "according to a shareholder email. Theranos" is nowhere to be seen in the outline link.

</comment></comment></comment><comment><USER40> Pardon my ignorance but what are the issues as to why something like what Theranos was proposing was so difficult?

Is it that the underlying tech is too hard or is there some basic engineering that doesn't exist yet?

(Ignoring the fact they didn't have a real solution / the whole thing was a scam etc)

<comment><USER41> My impression was that at least one issue is the sample size of blood needs to be large enough to be representative of the whole system.

If you pick 5 skittles out of a bag, no amount of technology can make it so you can reliably determine the frequency of each color over the whole bag.

There are other issues another comment describes well.

<comment><USER40> Good analogy.

I'm not a medical person so I'm not sure about the statistical sample volume required for typical tests. I do know that I've had comprehensive testing done and they took 5 tubes the length of my finger. That's pretty far from the drop of blood that Theranos were after.

The future has a way of returning to these things. We'll see if there's even a partial approach that could work soon enough. Or not.

</comment></comment></comment><comment> a-dub That's a shame. But hey, it doesn't take much solvent for one drop of blood!

</comment><comment><USER42> When you give blood they usually hide the bag, I suppose for the squeamish. But that drives me mad, just waiting there not knowing how much more to go - It's a natural progress bar!

</comment><comment><USER43> Alright.

So, can anyone answer the question, what's gonna happen to Ms Holmes and what are the possible career trajectories she may take?

Just wanna know what a brilliant person like her could do.

</comment><comment><USER44> How does the competition compare? [https://nightingalehealth.com/](https://nightingalehealth.com/) ?

</comment><comment><USER45> And poof goes the unicorn. Also enjoyed _Bad Blood_ its really well done.

</comment><comment><USER46> I'm sort of sad about this. I liked having a well known company headed by (and founded by) a woman to hold up as an example for my daughter. There are other billion dollar companies headed by women, but I think this was the only "science" one other than 23andme?

<comment><USER47> Does Jessica Livingston of Y Combinator not count? Is being one of the co- founders of a $100 billion tech incubator not sciency enough for you?

<comment><USER46> Jessica is already on my list, but she'd be the first to tell you she's not sciency. :)

<comment><USER47> Silly question: How sciency was Holmes? Did she personally help develop her (completely fraudulent) blood tests? Or was she merely a business woman in charge of bringing this bag of hot air to market?

(Hint: I don't really care if she supposedly helped develop it. It didn't actually work. She's not some kind of genuine scientist.)

I'm just gonna leave this here and suggest that most of whatever tech was developed by these 1000+ still active companies likely wouldn't have made it to market without YC:

[https://yclist.com](https://yclist.com)

(Also, this isn't intended as snark. I'm just cranky at the moment and seriously cannot see why it matters that Jessica "isn't sciency." My crankiness is for wholly unrelated reasons and has nothing to do with this discussion.)

<comment><USER48> How sciency was Holmes? Not very. She dropped out of college after one year. Although many people have had great success in software with this level of education, it's kinda hard to imagine somebody making major contributions to the life sciences without even a bachelor's degree.

<comment><USER7> I would say not at all.

</comment></comment></comment></comment></comment></comment><comment><USER49> It's really worth reading through historical HN threads on Theranos to get a feel for how the media was content to serve as a PR outlet for such a long time, and how people were so taken with the narrative Holmes and her allies pitched..

</comment><comment><USER50> This is my surprised face. :|</comment>


Ask HN: What was the Windows "refresh" button for? - <AUTHOR>

Why there was a "refresh" button in the context menu when you right click on desktop in Windows? <comment><USER3> You could refresh any folder in Explorer, not just your desktop. It's not just about Active Desktop 'michaelt mentioned (which had a refresh, but I guess it was a _different_ refresh, coming from IE and not explorer.exe), but - <USER2> 'UnoriginalGuy hinted - because Explorer could, and often did, go out of sync for various reasons. It didn't affect only networked drives, it happened equally well when you had enough many files in a folder (something must have been timing out) or your computer was overloaded. The most common case I recall - Explorer didn't automatically show files created by other programs, sometimes it didn't even show a folder or a file you created via context menu.

Actually, I'm pretty sure some of this still happens today, in particular I remember noticing on Vista/Win7 that Explorer sometimes doesn't immediately refresh the folder contents when there's a new file created by external application (e.g. a log file), and refresh/F5 is useful to get this file visible immediately.

Funny thing, per the phenomenon of operant conditioning, over the years of using Windows I learned to regularly refresh Explorer windows via F5 to ensure I always see what's really there, sometimes just for my own peace of mind.

<comment><USER4> An example of this: One thing that Windows versions up to at least 7 have always had issues with is that when you rename a file to be the same name with a slightly different case, say after changing an uppercase letter to a lowercase one, Explorer doesn't seem to pick up on the change until a refresh is manually triggered.

<comment><USER3> Oh, and here I always thought it just doesn't rename the file at all. NTFS is case-sensitive but Explorer is only case-preserving, so I thought it was just assuming I typed in the same name. When I wanted to change the case of a file name, I always renamed the file first to something else, eg. "Foo.txt" => "bar.txt" => "foo.txt". Thanks for the information :).

<comment><USER5> NTFS is case aware, but not really case sensitive.

<comment><USER6> How does that work? Did they implement case sensitivity and then decided to not use it?

<comment><USER7> It's more the case that NTFS is case-sensitive, but the Win32 APIs aren't.

</comment></comment></comment></comment></comment></comment><comment><USER8> It is possible, although rare, for Windows Explorer to get out of sync with what exists on the file system or virtual filesystem(s). The refresh button re-acquires the data from the source and re-draws the result for the user.

For example, if you open a network share, delete a file using another machine that file might take between several seconds to a minute to disappear visually (although if you try to use the file you'll get an error and it will refresh removing it). You can alternatively use the refresh button to get an updated view instantly.

It is mostly useful with non-standard virtual file system services rather than the normal NTFS/FAT32 file systems Windows uses.

<comment><AUTHOR> I understand but isn't it very odd to give end-user a button like that? Also, why Mac OS didn't have one?

<comment><USER8> OS X indeed lacks it, and it is a pain in the butt to some:

[http://osxdaily.com/2013/08/30/refreshing-finder-windows- in-...](http://osxdaily.com/2013/08/30/refreshing-finder-windows-in-mac-os-x/)

[http://apple.stackexchange.com/questions/60119/how-does- the-...](http://apple.stackexchange.com/questions/60119/how-does-the-finder- refresh-in-os-x-mountain-lion)

As you can see people have to come up with quirky workarounds to force refresh a folder on OS X, rather than just clicking a context menu button helpfully provided.

Others have created third party software to add it:

[http://www.macupdate.com/app/mac/24714/refresh- finder](http://www.macupdate.com/app/mac/24714/refresh-finder)

This has 46,000 downloads.

Both Windows and OS X fall out of sync for similar reasons: sometimes bugs, sometimes refreshing is slow/expensive so is done infrequently (e.g. over a network), and sometimes third party software providing "virtual" file system elements are terrible.

I don't really find the concept of a refresh button odd at all. But that's only because I've seen how many virtual file system providers these systems support and how quirky some of them are. If all they supported is native files on traditional file systems attached via reliable buses, then a refresh button wouldn't be required.

<comment><USER9> Interesting contrast of design philosophy:

Mac - "It just works. We refuse to believe that it doesn't."

Windows - "It mostly works, but when it doesn't, press this button."

<comment><USER10> For a company so self-infatuated with design, they sure did a great job making Finder a frustrating and near-useless piece of software.

<comment><USER11> One would be either infatuated with design or infatuated by the self, "self- infatuated with design" does not make sense.

<comment><USER10> "Infatuated with the image of the self as a designer" is what I meant. Self- infatuation with a design component.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Back in Windows 98 there was a feature called 'Active Desktop' that could use web pages as desktop wallpaper (or partial desktop wallpaper). It was intended to be an early version of desktop widgets like stock tickers. As these were basically web pages, you could refresh for the same reasons you might refresh in a web browser.

As you could execute javascript it was also possible to do things like change your desktop wallpaper when you resized or rotated your screen. But active desktop was never heavily used enough to have all the bugs in it sorted out - if you widget's javascript tried to display a message box you could trigger a crash, for example.

I assume that feature is gone now - but presumably you can still put files on the desktop, so presumably there's a refresh button in case you have some strange configuration like your desktop folder mounted from a network share.

<comment><USER13> Also it had horrible performance. Even without any active desktop content, just having it enabled was enough to make any desktop interaction painfully slow compared to having it disabled.

<comment><USER14> Most interestingly, the widgets from Windows Vista and 7 are just normal webpages, very similar to chrome extensions, actually.

</comment></comment></comment><comment><USER15> Like other people said, it is about refreshing the view for changes that didn't trigger an automatic refresh.

If you dig the details, behind the scenes an API called ReadDirectoryChangesW is called, which uses a notification-like system to report changes within a directory. However, that API is weird, so various types of changes are not correctly reported and explorer.exe is stuck with outdated data. The refresh forces it to update the view.

Disclaimer: I've had to use that API recently to code a simple python file monitor in Windows. [https://github.com/gusmd/vigil.py](https://github.com/gusmd/vigil.py) in case anyone is interested.

<comment><USER9> From the documentation: [https://msdn.microsoft.com/en- us/library/windows/desktop/aa3...](https://msdn.microsoft.com/en- us/library/windows/desktop/aa365465\(v=vs.85\).aspx)

 _If number of bytes transferred is zero, the buffer was too small to provide detailed information on all the changes that occurred in the directory or subtree. In this case, you should compute the changes by enumerating the directory or subtree._

I suppose that's the case when Explorer gives up, because for this to work it would require keeping a copy of all the directory contents to compare with, and "enumerating" would be unacceptably slow.

</comment></comment><comment><USER16> To add to the comments about file listings not refreshing, note that the desktop is just a fancy-looking Explorer file listing widget ("control" in Windows-speak).

<comment><USER17> It's also worth noting that the standard File Open and File Save dialogs are full-fledged File Explorer windows too.

I make use of this all the time. For example, I often want to open the same file in two different editors. So in the editor where I have the file already open, I do a Save As to get into the dialog, then simply drag the file directly from that dialog into the other editor, and close the dialog without saving.

Alt+D also works the same in these dialogs as an Explorer window, so a quick way to copy the current file's directory to the clipboard is to do a Save As, Alt+D, Ctrl+C, Esc.

Or to open a standalone File Explorer window somewhere in my current project: Save As, right-click the folder in the Save As dialog, and Open in New Window.

All kinds of nice shortcuts like this are available once you realize that the File dialogs are Explorer windows.

</comment></comment><comment><USER18> I'll add, "behaviour of Windows regarding floppy disk drives".

<comment><USER19> Correct! Windows didn't have networks properly until Win 95. So FDD status is the origin. Macs could eject floppies, PC's didn't have this.

</comment></comment><comment><USER20> Could be relevant for users on network connections which don't update state? But on the desktop explicitly, certainly seems odd.

<comment><USER3> It isn't. Sometimes you have a folder open and another program creates a file in it; Explorer may not update your display for another 30 seconds or so, so you can force the update with refresh.

</comment></comment><comment><USER21> If you ever work on two computers over a shared network drive with Macs working in the exact same folder you'll immediately know the answer to this question ;) I don't understand why every system doesn't have one.

</comment><comment><USER22> I use it when I do a Subversion update. TortoiseSVN puts a red icon on non- current folders and a green icon on up-to-date folders. Sometimes the icon doesn't change color when you update though, so you have to refresh.

</comment><comment><USER23> I wish Tortoise/SVN responded to F5/Refresh :o(

</comment><comment><USER24> it's there to force-render any changes made on the user-interface (explorer.exe, desktop) that aren't rendered properly.

</comment><comment><USER25> It's basically a workaround for a feature that never worked properly on windows: filesystem events in fs viewer apps.

</comment><comment><USER26> To keep the non-technophiles occupied while they wait for their external device to be detected, and to soothe them by giving them something to do (repeatedly) to "speed up" their ageing computer.

<comment><USER27> You are getting a lot of down votes, but the truth is that this behavior is very common in some cultures, and not all of HN may have seen it before.

When I get impatient I just swirl the mouse in a small counter-clockwise circle, but I have seen others do the rapid right click, refresh sequence. It was mostly Asian computer users[0], and some of them had practiced it enough that they would do this 3-4 times per second while waiting for the computer to react.

[0] I first noticed this in Iraq, but the Chinese students at school do the same thing.

</comment></comment><comment><USER28> In the past when CRT monitors were in usage,the ui needs to be painted on the screen.The crt technology refreshes screen so that pixels can work properly.If they are not refreshed,then some pixels become 'dead'.

<comment><USER29> That happens at a much, _much_ lower level than we're talking about here.</comment></comment>


New PC malware loads before Windows, is virtually impossible to detect - <AUTHOR> http://www.extremetech.com/computing/219027-new-pc-malware-loads-before-windows-is-virtually-impossible-to-detect?mailing_id=1524318&mailing=ExtremeTech&mailingID=D019A13C4B613C0E860C7EA8741CF8F6 <comment><USER2> Come on, bootkits are hardly new. You can detect them by just like you'd detect a rootkit, as they rather rarely cover each and every system API that can reveal its presence, and you remove them by firdt booting into an alternative OS, which most AV vendors provide.

For malware to be really tricky to remove you'd have to start infecting hardware firmware like BIOS or harddrive controllers, like IRATEMONK or IRONCHEF from NSA TAO do.

<comment><USER3> Remember the rootkit that lived in Mac keyboards ?

[http://www.zdnet.com/article/hacker-demos-persistent-mac- key...](http://www.zdnet.com/article/hacker-demos-persistent-mac-keyboard- attack/)

Or Thunderstrike ?

[http://www.zdnet.com/article/macs-vulnerable-to-virtually- un...](http://www.zdnet.com/article/macs-vulnerable-to-virtually-undetectable- virus-that-cant-be-removed/)

</comment></comment><comment><USER4> [https://www.fireeye.com/blog/threat- research/2015/12/fin1-ta...](https://www.fireeye.com/blog/threat- research/2015/12/fin1-targets-boot-record.html) \- it's an MBR (UEFI?) virus. "New", but not new.

<comment><USER5> "The installer will install the bootkit on any hard disk that has a MBR boot partition, regardless of the specific type of hard drive. However, if the partition uses the GUID Partition Table disk architecture, as opposed to the MBR partitioning scheme, the malware will not continue with the installation process."

It's a MBR attack and the modern Windows systems aren't typically MBR anymore.

<comment><USER6> I don't know about you but my primary system disk is an SSD, which is far less than 2 TB... Guess what kind of partition it is (and guess which one it came with)?

I've found AOEMEI (?) to be good for converting other partitions from MBR to GPT but their shareware version won't do boot partitions without paying ;)

<comment><USER7> Windows will not boot in UEFI mode if the partition table is of MBR kind. One must manually enable the BIOS legacy mode, hence the comment on modern Windows systems (younger than 4 years, say).

</comment></comment></comment></comment><comment><USER8> Bigger problem is at least two of the more well known AV solutions are badware. My enemy #1 in this regard is McAfee, but recently (front page now) Avast seems to have upped their game considerably.

<comment><USER9> Can you expand a bit on this ?

According to stopbadware.org a badware is a "[...] software that fundamentally disregards a user's choice about how his or her computer or network connection will be used."

<comment><USER10> Hm. I do have a candidate fitting this description. "But _of course_ you want to update to W __ __*s Nein, even though you have declined the popups, disabled the GWX Clippy abomination and disabled the specific updates; I will kindly reenable all of that for you. Oh, and I 'll also suck down 6 gigs of install data, it's not like you are using your metered pipe for anything useful anyway. Admit that you want it."

</comment></comment></comment><comment><USER11> I had one of these 2-3 years ago, it was pretty amazing to be honest. I hadn't gotten a virus in so long I was impressed at how much they'd stepped up their game.

Even fdisk /mbr from a windows bootdisk wouldn't get it. So I installed Linux and it STILL tried to f'ing load. Had to dd the whole mbr from a live linux disk. That worked. My next step would have been mounting it as a secondary drive on another computer.

So this isn't remotely "new" either. It's what I get for wanting to evaluate a video game before buying.

<comment><USER12> that's why I "evaluate my games before buying" under WINE in linux :P (of course that, not all of them run...)

<comment><USER13> Why not "evaluate" them under a VM instead? Seems a lot more likely to actually work...

</comment></comment></comment><comment><USER14> Looks like ExtremeTech is using some kind of adblock detection/injection suite to inject ads, despite adblocker rules, after the page is already loaded.

Quite ironic, considering that I classify attempting to work around client software like uBlock, just as shady of a tactic as boot sector malware.

<comment><USER15> I'm using only Ghostery, and I did not see any ads. Perhaps it stops such code from running?

<comment><USER16> An ad for Intel popped up on my first load with Ghostery.

Additional reloads just have a large gray element taking up 20% of my viewing area.

</comment></comment></comment><comment><USER17> this is not as scary as it sounds, because of that "annoying" uefi secure boot that ships by default on oem windows machines these days.

a trusted boot chain means you can't put malware at the start without a much more sophisticated attack than this.

<comment><USER18> It's also not compatible with GPT, so even if you have Secure Boot disabled but you're using GPT, it won't work. And for some reason it requires the .NET framework installed for it to work.

</comment></comment><comment><USER19> 3,2,1.... SecureBoot? I sure hope not. As with terrorism, the problem is not removing the owner from the equation any more than is removing privacy everywhere (or encryption without backdoors, or computers without rootkits... lots of parallels there), because "terrorism".

If we can wade through the power-grabs and social-engineering disguised as erudite commentary and philosophizing (similar to that surrounding national security), increasing transparency and user control remains the answer. Any software can have flaws, but software you can't fix because it's locked into hardware is worse. Worse yet is hardware that turns a computer into an single- purpose (flaws-and-all) appliance.

Any bootloader relies on a chain of trust. If the on-disk (OS) portion of that fails (incidentally, the biggest attack surface) and is vulnerable (likely - proprietary software can be fuzzed like any other), then the hardware-linked protection is at best annoying to the actual hardware owner.

In that sense, SecureBoot is actually an inversion of good security principles, which dictate simplicity and accountability/openness. The better place for signed loader verification is in the on-disk bootloader stub. If the OS were perfect, this would be enough too, but at least it is patchable (and the OS is re-installable) when it isn't.

A computer that can't be re-installed when you brick it is expensive garbage that was at best constraining while it even worked.

FOSDEM 2013 had a worthy social and technical overview of UEFI and SecureBoot I enjoyed:

[https://www.youtube.com/watch?v=NsoXFvGiAas](https://www.youtube.com/watch?v=NsoXFvGiAas)

<comment><USER20> Many Secure Boot implementations let you load your own keys. The "removing the owner from the equation" thing is not an issue with Secure Boot, but with particular manufacturers.

> The better place for signed loader verification is in the on-disk bootloader > stub.

That is already part of the Secure Boot. But who verifies the bootloader stub? The point is that you can't trust anything on the disk.

> Any bootloader relies on a chain of trust. If the on-disk (OS) portion of > that fails (incidentally, the biggest attack surface) and is vulnerable > (likely - proprietary software can be fuzzed like any other), then the > hardware-linked protection is at best annoying to the actual hardware owner.

Firmware verifies the (on-disk) bootloader, bootloader verifies the kernel, kernel verifies the drivers, and so on. The chain of trust is there.

<comment><USER21> > Many Secure Boot implementations let you load your own keys.

And there is no promise that this will not change.

<comment><USER22> That's a great reason to get rid of security features!

Might as well ditch TLS since soon you'll only be able to get certs for government approved content.

<comment><USER23> Please allow for the possibility that the word "secure" is no more than an attempt by a company (Microsoft) to leverage your fears and co-opt your natural pursuit of safety in order to help make a consumer-restricting technology appear to be a feature. Would you have as much faith in the technology under a different name? Perhaps: MicrosoftBoot (implying it could only boot a Microsoft OS, or the specific version of Windows your PC came with)?

(In a sense, dropping TLS is the correct response... In the sense, of not using the limited set of services. The corresponding response here is to not buy PCs with SecureBoot present in any imposing way, which may mean boycotting "modern" computers that are no longer general, user-controlled, devices if, in the future, they all are locked to Microsoft out of the box.)

</comment></comment></comment></comment></comment><comment><USER24> Bootsector viruses, they are back. Nothing new.

</comment><comment><USER25> A competent repair shop will do what they've done since the late 90s and pull the HDD from the computer, hook it up to a second computer and scan it. Not much is "undetectable" when you do that.

<comment><USER10> Yup. This is one of the oldest classes of malware (second only to the Great Worm), back when they were called "viruses" and travelled in floppy disks' MBRs.

Early 1990s nostalgia strikes back ;)

</comment></comment><comment><USER26> Secure boot would counteract this?

<comment><USER27> Yes. Your system will simply fail to boot in that case.

</comment></comment><comment><USER28> fdisk /mbr

</comment><comment><USER29> Related articles were posted but got no discussion: [https://news.ycombinator.com/item?id=10691725](https://news.ycombinator.com/item?id=10691725), [https://news.ycombinator.com/item?id=10691613](https://news.ycombinator.com/item?id=10691613).</comment>


Ask HN: How to acquire a small website? - <AUTHOR> There's a small web-based game that's been largely abandoned by it's creator. I've opened up a line of communication with them and I'm interested in acquiring it.
I'm almost entirely interested in simply keeping the game alive as a side project. There's existing, minimal advertising which I'm interested in keeping so that the service can be self-sustained.
What due-diligence should I undertake when pricing and communicating with the creator? What type of things should be included in the purchase? What type of legal paperwork is required in this transaction?
Lastly, what are some tips for offering a price that's fair and reasonable? Your help is greatly appreciated. <comment><USER2> You will probably want at minimum the source code and some additional hours of support in case something goes wrong where the support could expire in a few months.

Effectively what you need to think about is when you purchase the website, what might go wrong and what will you need to get it back and running? Once the sale is complete, if there's nothing stated in place, the seller has no obligation to fix any issues.

</comment><comment><USER3> The [https://flippa.com/](https://flippa.com/) service will give you a good feeling for the "market price" of various website.</comment>


Ask HN: Selling links good idea or bad? - <AUTHOR>

What are your feelings on being approached by SEO/growth hackers asking to place do-follow links on your sites/blogs for money? Good idea, bad idea, indifferent? Would you take the money and put up the link? <comment><USER2> Bad idea. I get an e-mail or two a week from these places wanting either just a link or a "sponsored post" on my blog.

Besides the fact that "selling" links is against some Google AUP/ToS, it just doesn't seem right.</comment>


Show HN my weekend project: Better auto-brightness for Android - <AUTHOR>

Hi HN,
I got really annoyed by my Android phone's ambient light sensor adjusting the brightness too often and too much. But turning off the automatic brightness lead to getting blinded at night, which was not a good solution.
So I decided to do something about it over a weekend some time ago. The result is a simple app that adjusts the brightness to follow the outside daylight. When the sun goes down it starts ramping down the brightness and when it goes up again it ramps it up again. The times of sunrise and sunset are calculated from the current location.
I've found it actually works quite well, so if the standard automatic brightness annoys you as much as it annoyed me, please try it out.
It's available on Google Play market here: https://play.google.com/store/apps/details?id=se.japanska.android.daylight
There's also a free one-week trial here: https://play.google.com/store/apps/details?id=se.japanska.android.daylight_lite <comment><AUTHOR> Clickable:

Full version:

[https://play.google.com/store/apps/details?id=se.japanska.an...](https://play.google.com/store/apps/details?id=se.japanska.android.daylight)

Free one-week trial here:

[https://play.google.com/store/apps/details?id=se.japanska.an...](https://play.google.com/store/apps/details?id=se.japanska.android.daylight_lite)</comment>


Sam Ruby, Brendan Eich, and Jeremy Ashkenas on CoffeeScript and "JS-next" - <AUTHOR> http://intertwingly.net/blog/2010/11/25/Hobgoblin-of-Little-Minds#c1292138238

<comment><USER2> The bottom line is while all the debate about how to improve Javascript is going on, all the while with no real changes coming to all browsers (I'm looking at you, IE), Jeremy went ahead and shipped something that's great that you can use now. As usual, the people who ship will win. Good luck with all the wrangling of the big vendors to change a tiny bit of syntax, I'll be happily sitting here writing CoffeeScript _today_.

All that's missing is a layer of tooling in modern browsers (Chrome, FF) that make it so you can look at CoffeeScript as if it were in the browser, and the abstraction would be pretty complete. You'll still have to precompile the stuff on your server, which sucks, but practically speaking we're not talking about anything that can't be clean and easy to use without appropriate tools. Generally speaking client side code is short and sweet, so running your system in development mode where the script compiles on the client and doing a full compile server side for production mode isn't that far off from doing a debug vs release build in the world of native apps.

<comment><USER3> Brendan opened a Firefox ticket this morning to make line-number mapping possible, and that's really the biggest outstanding issue for debugging, since the semantics are otherwise one-to-one. In fact, it would make <script type="text/coffeescript"> tags a lot more fun to work with than they already are, since debugging through an "eval" would be far less painful if exceptions pointed back to the proper position in the original source.

<https://bugzilla.mozilla.org/show_bug.cgi?id=618650>

<comment><USER4> We could go one step farther than line number mapping and just define and implement a standard for full-on support for original source pointers. Then we could implement any number of langs using minified Javascript as an intermediate language.

<comment><USER5> The bug I filed based on Jeremy's suggestion is about source coordinates, not line numbers. We are way past the ancient mistake of numbering lines but not columns, which bites minifiers all the time.

</comment></comment></comment></comment><comment><USER6> I'm not sure I believe in a new "built from scratch" standard language for the web. Sure, we could get rid of all the JavaScript cruft and mistakes, but wont we just replace them with fresh cruft and mistakes in the new language?

I believe in evolving the core JavaScript to be more flexible, and then innovate at a level above JavaScript, like CoffeeScript (or my own <http://mascaraengine.com>).

ECMA should not so much focus on building more powerful abstractions (like classes, packages) into the core language, but rather on making the core more flexible. E.g. adding continuations (if possible) would be much more valuable than adding classes, because classes can already be emulated at a higher level.

Stronger support in browsers for debugging would help everyone.

<comment><AUTHOR> I'm with you there, to an extent. My bet is on some sort of bytecode standard as the next step in client-side browser code. Language designers could iterate more rapidly with a common compilation target at a level lower than JavaScript.

All the major browser JS implementations are moving towards the same type of VM. It's just a matter of time before one of the browsers adds support for running bytecode from a <script> tag.

The web moves forward by progressive enhancement, not by grand sweeping redesigns. So I think "JS-next" will be motivated not by committees and specifications but by incremental attempts to expose technology that's already in place (modern browsers' fast JS VMs).

<comment><USER4> _So I think "JS-next" will be motivated not by committees and specifications but by incremental attempts to expose technology that's already in place (modern browsers' fast JS VMs)_

If we had some sort of standardized support for "original source pointers" then we could have any number of languages in the browser as first-class citizens. They would just use minified JS as their compiler target. Development and debugging could be entirely in the new languages.

This would be a relatively small change, but it would open up innumerable opportunities.

<comment><USER7> Something like the #line directive [1] from C# would be useful, though it would only work in pre-compressed JS. The real challenge would be adding support in the various 'developer tools'/consoles.

1: <http://msdn.microsoft.com/en-us/library/34dk387t(VS.71).aspx>

</comment></comment></comment></comment><comment><USER3> The original blog post that kicked off the conversation is here: <http://brendaneich.com/2010/11/paren-free/>

Some previous discussion and counterpoints here: [http://www.reddit.com/r/programming/comments/eb3xt/so_you_ki...](http://www.reddit.com/r/programming/comments/eb3xt/so_you_kids_want_coffeescript_do_you_brendan_eich/)

</comment><comment><USER6> The idea about supporting source coordinate mapping in Firefox/Firebug is great! This could make it much more pleasant to debug generated JavaScript.

</comment><comment><USER8> _So your "do both" suggestion is good, if it is possible: evolve JS while tracking up-and-coming languages, and try to align JS as it evolves with the best-of._

C# seems to have pulled this off over the years. It keeps taking ideas from other languages (I'm mostly aware of the Ruby ones) and leaping forwards. It's just a shame there's a stigma attached to it.

<comment><USER5> Good point. C# also has the advantage of being single-vendor if not single- designer.

That single-vendor status, and the identity and reputation of the particular vendor, account for a lot of the stigma, in my opinion. This in spite of C#'s technical merits and more responsive evolution compared to, say, Java (which is also all too clearly single-vendor now, if it wasn't always).

JS evolution is on the uptick, but can Ecma TC39 keep pace while specifying the changes correctly and clearly?

</comment></comment><comment><USER9> _"Let a thousand little languages bloom, before picking your bouquet."_

That's a fantastic way of approaching web standardization.</comment>


New cloud CRM for small business. Easy invoicing. Unlimited staff - <AUTHOR> http://universocrm.ru

<comment><AUTHOR> It is made for long-lasting deals, store all customer information. Easy to send invoices, track contracts. The main features are - comments, tasks and files could be attached to any document or object in system. Deep links between objects help you to switch between documents in 1 click. Check it out, if it's worth translating to English?</comment>


Ask HN: Looking for a hosted job board solution... - <AUTHOR>

I'm looking for a hosted job board solution for a site that I'm getting ready to launch. I would also consider an open source solution but only if it is quick and easy to deploy and setup. Can anyone make any recommendations? Thank you. <comment><USER2> <http://www.jobboard.io/> looks promising. Never used it myself though.</comment>


Ajenti -  the web admin panel everyone wants  - <AUTHOR> http://ajenti.org/ <comment><USER2> Thanks!

Just installed it in Ubuntu 12.04! After trying to access the panel in the default port 8000 my connection was refused. Netstat showed that the app was listening in that port, etc. So, if someone have the same issue, you should use "Https" instead of "Http". Just a small note, maybe you guys know that already, I didn't :9</comment>


Google Hasn't Stopped Reading Your Emails Despite Making Announcement a Year Ago - <AUTHOR> https://yro.slashdot.org/story/18/05/14/0630230/google-hasnt-stopped-reading-your-emails <comment><USER2> Every 2 weeks on payday, Google reminds me that my electronic pay receipt is due. Thanks! Glad your looking out for me. Dumbass.

Even more ridiculous, it doesn't remind me when my phone or credit cards are due when they notify me.

<comment><USER3> > Dumbass.

You could use a different email provider...

<comment><USER2> You mean like Yahoo?

<comment><USER3> Here's a start: [https://www.privacytools.io/#email](https://www.privacytools.io/#email)

<comment><USER4> Protonmail is great.</comment></comment></comment></comment></comment>


Resolving cross site scripting issues. - <AUTHOR> http://ayende.com/Blog/archive/2010/09/18/resolving-cross-site-scripting-issues.aspx?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+AyendeRahien+%28Ayende+%40+Rahien%29 <comment><USER2> It's javascript injection.

But the clever method of finding the result seems as encouraging as clever methods for finding null pointers. Sure, try initializing your memory beforehand to a call to the debugger - (or just 0 and have that trigger the usual exception handling). Sure you can do this but those null pointers keep popping up. I'd assume you could find analogy for SQL injection too.

I'm more interested in techniques which prevent this from happening to begin with. The clever techniques often only help you find stuff you have a good idea is already there.

<comment><USER3> AFAIK for JavaScript there is no systematic protection like for CSRF (CSRF token), but the use of a templating engine reduces the risk. You can also order a scanning service like <http://www.godaddy.com/security/website- security.aspx>

<comment><USER4> +1 for template engines.

Cheap scanning services only go so far. Any sane template engine should automatically escape all strings when outputting an HTML/XML document, unless the developer explicitly tells it not to. Django does this perfectly. A lot of other modern frameworks also has secure defaults.

PHP is a PITA because it is a template engine in some sense, but it doesn't escape anything by default. PHP's last attempt at something like auto-escaping was magic quotes, which was an epic failure. The few times I need to write vanilla PHP, I end up defining an escaping function and use it instead of echo.

<comment><USER5> You shouldn't forget that blacklisting is not enough. Whitelisting is usually as important (specially for displaying rss full of html), and there are far fewer open implementations.

</comment></comment></comment></comment><comment><USER3> Nice trick. I didn't know, that firebug & co support soft breakpoints by inserting the javascript command "debugger;".</comment>


Computer science major is cool again, college enrollments up 8% - <AUTHOR> http://www.networkworld.com/news/2009/031409-computer-science-majors.html?page=1 <comment><USER2> An important question is whether the retention rate will sustain along with the rise of enrollment.

I'd be wary of the motivation of those now suddenly deciding to pursue a CS degree who in a different economic climate would have chosen a different path (e.g. investment banking, financial services, etc.)

I have a suspicion that these folks that do follow through with getting a CS degree are really grooming themselves to hold positions in tech management versus jobs that involve actual coding and engineering.

We saw the reverse effect at the end of the dot com era. Those that had no real passion for technology dropped out leaving those who truly care about the craft of programming to remain and to innovate.

<comment><USER3> A CS degree is hard. What does a fad CS major do when he runs into the compilers or OS class?

If I were looking for a relatively easy way to make money while setting myself up for future management opportunities then I'd study accounting, personally.

<comment><USER4> Valid point, but people who are just in it for the economics might go for what's classed as an information science or management of information systems degree, which are usually viewed as easier than the mainline computer science degrees.

</comment></comment></comment><comment><USER5> The _raw number_ of comp sci majors is up 8%. That doesn't mean comp sci is "cool again." There are more people going back to school -- enrollment is up across the board.

</comment><comment><USER6> Repeat after me, more programmers is not the same thing as better programmers.

<comment><USER7> On balance, though, I think it's better to have _more_ people trained in CS rather than fewer. Most of these people won't become programmers, but they will apply CS ideas to their own professions.

</comment></comment><comment><USER8> "the popularity of computer science majors among college freshmen and sophomores is because IT has better job prospects than other specialties, especially in light of the global economic downturn."

An old joke:

\- Scientists learn to ask "why does that work?".

\- Engineers learn to ask "how does that work?".

\- Accountants learn to ask "how much does it cost?".

\- Liberal arts majors learn to ask "do you want fries with that?".

So yes, maybe economic necessity is driving here.

</comment><comment><USER9> so...we using "cool" for economically competitive now?

</comment><comment><USER10> Computer science was never cool. I personally think that's cool.</comment>


Spotify releases the source code of its Winamp clone - <AUTHOR> http://spotiamb.com/ <comment><USER2> I don't read anything in that page that says this is a Spotify product... It even says: "Spotiamb is not an officially supported product of Spotify®."

<comment><USER3> The source code (linked from that page) is at [https://github.com/spotify/spotiamb](https://github.com/spotify/spotiamb) and the license says copyright Spotify ([https://github.com/spotify/spotiamb/blob/master/LICENSE](https://github.com/spotify/spotiamb/blob/master/LICENSE)), so it seems that it was at least made by Spotify engineers, even if it's not "officially supported".

</comment></comment><comment><USER4> BitDefender blocks this site because of "Malware site".</comment>