SSLsplit – Transparent and scalable SSL/TLS interception - <AUTHOR> http://www.roe.ch/SSLsplit <comment><USER2> A few things for everyone to think about. This tool seems to be aimed more on the non-interactive side. There are several other good tools out there which do this, but most of them are not oriented towards performing software assessments. Webmitm does good for HTTP/HTTPS, as does Burp Suite (transparent non-proxy aware stuff). There are a lot of tools in this space. There are very few that will let you interactively debug non-HTTP(s) TCP and SSL.

I released a tool with a colleague back in 2010 designed for assessing non- proxy aware (mostly non-HTTP(S)) applications. It was aimed at getting those hard to reach TCP and SSL wrapped TCP apps that other proxies don't let you work with interactively. Mallory does the exact same on the fly cert generation etc. As does Burp Suite a professional grade HTTP proxy, that can operate in transparent mode. I much prefer Burp to webmitm for day to day work.

SSL Split also supports more NAT mechanisms than Mallory and most other tools (which just tend to be iptables/Linux aware). That is one of the real nice pieces of this code.

We did add in a few neat things into Mallory. SSH MiTM that, when it works, lets you open up your own PTYs on the back of the user's SSH session. A GUI that lets you do binary level regex to play with traffic on the fly. HTTP plugins along with a Chrome extension for hijacking sessions and some other fun things, which were mostly just for demonstration of what a MiTM proxy can do and be. Making a MiTM proxy protocol aware can be very powerful. Mallory is still a little buggy and tricky to use, but it has served me well in performing blackbox app assessments for many years.

[http://bitexploder.com/BlackHat-USA-2010-Umadas-Allen- Networ...](http://bitexploder.com/BlackHat-USA-2010-Umadas-Allen-Network- Stream_Debugging-with-Mallory-wp.pdf) (Check this out if you want an overview of how to configure a system to support a tool like SSLSplit or Mallory)

[https://bitbucket.org/IntrepidusGroup/mallory](https://bitbucket.org/IntrepidusGroup/mallory) (reasonably up to date code, its not the easiest thing to set up, though).

</comment><comment><USER3> Overall, very well written proxy. Just few nitpicks from browsing the code:

[https://github.com/droe/sslsplit/blob/master/pxyconn.c#L991-...](https://github.com/droe/sslsplit/blob/master/pxyconn.c#L991-L1012)

there is no guarantee that a space comes after the colon. These comparisons are better off with 1 character less.

[https://github.com/droe/sslsplit/blob/master/pxythrmgr.c#L12...](https://github.com/droe/sslsplit/blob/master/pxythrmgr.c#L124)

pthread_mutex_init can fail.

<comment><USER4> On linux, pthread_mutex_init always returns 0. But yes, according to POSIX, the function might fail (the common response is generally to assert() in this case)

<comment><USER3> On linux, pthread_mutex_init can fail and return ENOMEM.

<comment><USER4> No, it can not, at least on non-obsolete GLIBC. [http://fossies.org/linux/glibc/nptl/pthread_mutex_init.c#l_4...](http://fossies.org/linux/glibc/nptl/pthread_mutex_init.c#l_40)

<comment><USER3> You should refer to the man pages not particular implementations.

</comment></comment></comment></comment></comment><comment><USER5> Isn't way easier to hijack the DNS requests of the victim, redirect the connection to a similar unknown domain which replicates the HTML code and fields offered by the originally requested website[1]? I think Metasploit can do something similar.

I mean once you're in a position where using SSlstrip of SSLsplit or whatever, means that you gained access to the victim's LAN.

That's why programs like DNSSEC or DNSCrypt should be installed by default on laptops who use often Free WiFi/Internet Caffes, etc.

Funny thing is that, after all these years there's no way to implement an ARP poisoning mitigation policy that will protect all your clients no matter what OS they run (iOs/OSX, Linux/Android, BSD, Windows, Embedded, etc.).

[1] What comes in mind is a ruby Sinatra application which reads the targeted website's output and creates css/haml output on-the-fly.

<comment><USER2> If you have a captive audience, DNS, etc. can still be much more difficult. Think, malicious wifi hotspots where you can totally dominate everything about the victim's Internet access. But, generally, you are right, these tools require a certain level of access. I have never used one on an internal network assessment. I have done a small amount of arp poisoning on occasion, which you could then use a tool like ssl strip with, but my needs were different :)

</comment></comment><comment><AUTHOR> This tool more than being a ssl interception tool, is useful to find privacy leaks such as Mac OS X Yosemite sharing of Spotlight searches with Apple. [https://fix-macosx.com/](https://fix-macosx.com/)

</comment><comment><USER6> I'm not sure how this is "scalable", the "scalable" thing about tools like sslsniff was that earlier versions of SSL used a mechanism for key exchange where the MITM could cache the key negotiated between the client and server, and passively log the encrypted data paired with the intercepted key. decryption can then be done offline, in parallel. that scales, and the MITM component is resource-limited at the rate it can exchange packets.

this requires an active attack, so the MITM is doing double duty for an intercepted session, since it has to pin two session keys together for each endpoint in an intercepted session and decrypt/encrypt. scaling that is harder, since for larger networks you need a relatively constant amount of processing power relative to the number of connections per second and stuff like AES-NI only goes so far. and then you investigate cryptographic coprocessing hardware or GPU acceleration and discover that data transfer speeds on commodity systems become a problem, and now to "scale" your attack you are building custom hardware that both needs to have the intense data plane capacity of high end switches and routers with the intense processing capability of HPC systems.

it's not fun. and it's a hard and interesting challenge to write this kind of software and I commend the authors for doing so but I don't think that active attacks "scale" by definition. you're going to wind up with either a ridiculous amount of custom hardware or only intercepting some percentage of traffic.

</comment><comment><USER7> Well, that's horrifying to see exist as a sysadmin (though I am sure plenty of blackhats have such tools).

<comment><USER8> The attacker must install a CA certificate on the users' computers so he can strip/split their SSL/TLS sessions. Frankly, that's the sysadmins who are using this type of tools the most for monitoring the browsing habits of the employees.

<comment><USER9> No wonder NSA puts a greater deal of focus on hacking sysadmins. Once those individuals are hacked, the data floodgates open.

</comment></comment></comment><comment><USER10> How is that different from sslsniff/sslstrip or webmitm from dsniff?

<comment><USER2> Fundamentally it isn't all that different. One neat thing is the multiple NAT mechanisms supported. There are at least a half a dozen tools I can think of that do this. But it is a very nice, clean, small, high performance, written in C, MiTM proxy.

</comment></comment><comment><USER11> It would be really nice to see a write up on ways to prevent an attacker from effectively using this to intercept and decrypt traffic in this way... Like for example what are a few measures you could take to better protect a standard nginx or apache deployment?

<comment><USER2> Use HSTS. Never use HTTP even to redirect to HTTPS. That is one of the surest ways to prevent users from getting hijacked without knowing it.

If you are developing any kind of client application where you control the certificate authorities, throw them all away. Use certificate pinning in the client and reject any connections that present a certificate other than your known, pinned, certs.

In a web application, keep an eye out for suddenly changing IP addresses. If the user's IP address for a session changes, terminate the session immediately and force the user to authenticate again. This is a common, if paranoid, measure. Alert the user that their IP address has changed. A security warning is sufficient. Most likely they would be getting this attack in a coffee shop or some sort of untrusted Internet connection, so you have to tell them MiTM may be happening and they should be on alert. Defending from the server is hard.

<comment><USER12> How are you supposed to get them to https the first time if they type in [http://site](http://site) ? I'd suggest rephrasing that to "use HSTS even if you also redirect http to https". Of course it's not secure, technically, but are you willing to annoy (and lose) users until browsers only use https? If you expect visitors only via links, then I suppose you could do away with http, but I don't think any business that cares more about money than about making the world a better place (any public company and most private companies) would want to stop accepting connections on port 80 today.

Binding a session to a specific IP might be more secure for the typical case, but it will annoy the living crap out of fringe, but legitimate, users. As already mentioned, Tor users would bear most of the pain and suffering, but if your service supports multipath TCP or something like it, a simplistic "store connecting IP with the session" approach seems like it would cause those users to suffer, too, although not as much.

It's also possible the client might be in a corporate environment with corporate SSL (MITM) proxies, and maybe there's a cluster of them so the public client IPs change for different connections. So you'd have to bind sessions to networks, not individual IPs, but what network size do you use? Then even odd MITM attacks that don't use the client's real public IP could use another IP on the same subnet as the real client to connect to the remote service, so how much do you actually gain?

If session cookies are httponly and secure, what's the reason for binding sessions to IPs?

If it were just Tor, you could set up a hidden service, and detect clients that are connecting from Tor exit IPs and redirect them to the hidden service. But it's not just Tor.

<comment><USER2> Binding a session to an IP is just a defense in depth measure. On its own it doesn't buy you a lot, but it is something and it can matter in a small set of circumstances. I would not recommend this as a generalized approach, but I was trying to answer the question.

Also, httponly and secure don't help you with a mitm that is ripping apart your SSL.

Also, if they type in [http://](http://), they simply don't get anything. If you serve even one thing over [http://](http://), you give a tool like sslstrip the foothold it needs. Again, this is appropriate for a subset of applications and situations, not a broad, consumer oriented site.

<comment> mike-cardwell "Also, if they type in [http://](http://), they simply don't get anything"

If I were writing an SSL strip style tool, I'd make sure it listened on port 80 and 443, and then even if the end-site didn't support http, I'd still pick up the http connection and forward it on to the real site via HTTPS.

I don't see the value in not providing a HTTP redirect. A MITM can still pick up a HTTP connection, even if you're not listening for it yourself...

<comment><USER2> Because, the user's browser will remember that it should be HTTPS. With HSTS the user's browser will refuse to go to the HTTP at all. Thats how HSTS works, the browser remembers that the site has the HSTS setting.

HSTS also prevents the overriding of the bad certificate message. It is like anti-ssl strip. HSTS is harder to get around than this :)

<comment> mike-cardwell I know how HSTS works. I was responding to the claim that offering a HTTP service which redirects to HTTPS somehow reduces security, even when HSTS is in use.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> The conventional wisdom is that it's not possible to detect MITM attacks other than by using some trusted path to validate the credentials from the other end. But that's not quite true. When an attacker decrypts with one key and re- encrypts with another, the encrypted bit stream changes. Both ends now have different encrypted bits. If they can somehow compare them, a MITM attack can be detected.

One early secure telephone unit displayed a 2-digit number derived from the beginning crypto bits. Users were supposed to confirm, by voice, that both units showed the same number. An attacker would have to break into the voice stream and substitute voice words in a matching voice to prevent that detection.

This illustrates what's possible. It's possible to force a MITM attacker to do considerable work (perhaps an arbitrarily large amount of work) to prevent both ends from comparing notes on what crypto bits they have. More than that, the endpoints can force the attacker to have to construct an arbitrarily complex lie in the form of impersonation of content.

David Chaum (of DigiCash fame) claims to have developed a way to detect MITM attacks along these lines. See U.S. Patent Application # _20060218636._

The USPTO rejected the patent application, because of prior art from Microsoft (U.S. Patent # 7,475,421) for "Automatic Re-Authentication", which is about recovering disconnected Microsoft Terminal Server sessions securely and is limited to re-connection. So Chaum's approach seems to be unencumbered by patents. However, his explanation is almost incomprehensible. There's a thesis that explains it, though.

[http://www.cisa.umbc.edu/papers/theses/newton- thesis-2010.pd...](http://www.cisa.umbc.edu/papers/theses/newton- thesis-2010.pdf)

Even that is heavy going. Here's a simple explanation of the concept.

if both ends can compare some of their crypto bits, they can detect a naive MITM attack that's decrypting and re-encrypting at the transport level. A smarter MITM attack would detect and rewrite that exchange of info, even if it occurred at a higher protocol level, like HTTP. However, the effort required by the MITM attacker can be made very large, and the MITM attacker can be forced to introduce delay.

An example approach would be to send an HTML or XML document which contains an item showing the N crypto bits that both ends should be seeing. Wrap the entire document with an item which has a cryptographic hash of the entire document, and send the hash BEFORE sending the document content. If the attacker just sends the HTML/XML through unchanged, the attack will be detected. If they change the item containing the N crypto bits, the hash will be wrong and the attack will be detected. If they generate a fake document with suitable crypto bits and hash, they have to do so before they've seen the entire content of the actual document. If they buffer up the entire document so they can modify the document, they introduce delay equal to the transmission time for the entire document. It should be possible to detect that delay.

For concreteness, suppose the server does the SSL/TLS handshake, then sends the HTTP headers, which contain the cryptographic hash of the material to follow. This is done as fast as possible. The server then sends most of the rest of the document. But at the end of the document, it pauses until 3 seconds have elapsed from receipt of the HTTP request before sending the last hundred bytes or so. Most of the document will still render, although "onload" Javascript won't trigger yet.

At the receiving end, the browser only allows the server 2 seconds from HTTP request to headers received. If the server can't keep up, the page will be treated as untrusted.

This provides considerable MITM protection. An attacker must be able to fake page content to defeat this.

<comment><USER14> It's an interesting idea but it fails on slow connections, network problems etc. As an attacker I might even start b6 sending a request for something trivial (favicon or something) before I receive anything.

Also as an attacker the effectiveness of your mitigation depends on what it is I want - by this point I have some plaintext and know what protocol you're using.

</comment></comment><comment><USER15> You can still detect that you are intercepted by checking fingerprints and/or green bar [https://www.grc.com/ssl/ev.htm](https://www.grc.com/ssl/ev.htm) ... don't you?

<comment><USER16> You will detect it even sooner - the root certificate that signs the certificates for the MITM is not recognized by your browser (unless you manually installed it). You will get a nice, big, red warning on every modern browser. The tool doesn't claim otherwise. An example useful usage is testing your app that communicates using SSL and seeing what's under the hood. In that case, you would install the root certificate manually so the app (or OS) wouldn't reject it.

<comment><USER17> It strike me that this tools works (or is perhaps designed to be?) a proof-of- concept for how things are done by those Agencies that keep showing up in the news.

They will simply have (by hook-or-crook) several of the root cert private keys for the already-installed roots. There's a few dozen of them and any one will do. Just fry-up forged MITM certificates as needed. I doubt the target would even notice the tiny delay during handshake.

As you say, no one checks fingerprints. I think fingerprints would only help if you had visited the site before without a MITM, _and_ your SSL layer flagged changes under ALL circumstances, remembering the fried-up MITM cert will look 100% legit.

I wonder if there is a privacy-protecting way to share certs/ids to detect these changes? (or is there one already?)</comment></comment></comment>


Git LFS 2.5.0 is now available - <AUTHOR> https://blog.github.com/2018-07-30-git-lfs-2.5.0-now-available/ <comment><USER2> The new 'git lfs migrate' command will help when accidentally committing files that should've been git-lfs but weren't.

</comment><comment><USER3> Is it free yet? ><</comment>


The Ivy League, Mental Illness, and the Meaning of Life - <AUTHOR> http://www.theatlantic.com/education/archive/2014/08/qa-the-miseducation-of-our-college-elite/377524/?single_page=true

<comment><USER2> This is the fourth posting of this article in the last couple of days:

[https://hn.algolia.io/#!/story/forever/prefix/0/the%20ivy%20...](https://hn.algolia.io/#!/story/forever/prefix/0/the%20ivy%20league%2C%20mental%20illness%2C%20and%20the%20meaning%20of%20life)

</comment><comment><AUTHOR> Note to mods: I accidentally linked to the second page. Hopefully you can change the URL to point to the first page.</comment>


Ask HN: Applied Computing MSc in U of Toronto - <AUTHOR> I have applied to join the University of Toronto Applied Computing Masters program that starts in september this year. I do not come from a STEM background, but do work with data analysis and wish to develop ML skills.
There are a few questions that I could ask the admissions office, but I would like to read opinions from more neutral sources:
1. What kind of career prospects should I expect after graduating? I aim to work with Machine/Deep Learning, but I have no experience in Industry. I also have no idea how the Ontario market is, but am willing to move.
2. U of T is renowned in Computer Science, but this is a new course that has only been offered since 2010, and I believe it is a Professional MSc. Is this in any way viewed as "less" compared to a regular MSc by industry? Any other remarks? <comment><USER2> There is a huge problem in Canada with under employment and poor pay. A lot of young people with some serious skills are working away at jobs that could be done by Best Buys Geek Squad. You have guys with a MCS making 65k a year. You will need to focus on leaving Canada and finding work in the US. There is no future in Canada.

U of T is a great school. You will not have a problem getting a very respectable salary and a great job in the USA.

At the risk of sounding like a douche, I left Ontario many years ago for the US and have never looked back. Without getting into too much detail, I made more in the US in the first 10 years then I could have ever made in my lifetime working in Canada.

Good Luck...

<comment><USER3> I am guessing making money is important for you, may I know what kind of company did you work for? There are lot of companies in Canada now that have made some mark in last few years like HootSuite, Shopify & Slack(?). Also I know lot of Canadian tech workers (educated in Canada?) have founded startups in USA, which makes me think it's more of a ecosystem problem.

<comment><USER2> I have been in the Cyber Security Industry for the last 17 years. I have worked for large Tech Companies.

Since I and my children like to eat and no one left me any kind of large inheritance, money is a factor. If you feel that it is not important then there will be many opportunities for you to utilize your new skills after completing your studies.

My wife who is an expert in her field has spent time helping companies in a certain industry implement massive new systems. While on her many stints in Canada (GTA) she has noticed that there is an extreme level of under employment. CS Engineers from UofW working for 52k a year doing administrative type tasks. One Gentleman who had a MCS from UofT was earning a salary in the low 60's doing tech support for a system. In comparison I was earning over 6 figures in 2005 working as an Cyber Security Specialist. These are just a few examples and there were many more.

I envy you that you are able to live a care free life where money is not a factor in your pursuit of knowledge and survival. There will be many employers from you to choose from if this is the case.

Good Luck..

<comment><USER3> It's important to me as well but what's more important is the lifestyle and the amenities as well. For e.g living in Silicon valley with higher rents, child care, bad commute and on a work visa, one cannot really think of long term settlement. I have seen Amazon, Facebook, Google have offices in Canada along with these companies I mentioned and that's where I feel little confident that those guys should pay out reasonable wages. I would rather look at this at meta level instead of counting acquaintances here for this gentleman's question.</comment></comment></comment></comment>


Advertising 2.0 does not exist - <AUTHOR> http://www.gapingvoid.com/Moveable_Type/archives/003823.html <comment><USER2> Quoting no. 6: "So a lot of clients have been recently asking their ad agencies, 'So what can you do for us in Web 2.0?' And the agencies have been replying, 'Lots! Lots and lots and lots and lots!' Bullshit. Ad agencies have so far been hopeless in this space."

An opportunity awaits.

<comment><AUTHOR> How so? care to elaborate?

<comment><USER2> Ah, you need to join my YC founder's team first...

(Actually, I'm not applying to YC, but I am working on something in this area.)

<comment><AUTHOR> What's that?

<comment><USER2> Hey sorry I didn't notice your reply sooner (we need a reddit style "inbox" at login).

That project is SeekSift.com.

<comment><AUTHOR> Nah it's fine. And you're right we do need need a inbox to warn us if we have a reply on our thread :-)</comment></comment></comment></comment></comment></comment>


Ask HN: When will we say "We used to have to charge phones with a wire??" - <AUTHOR>

I predict 2019. <comment><USER2> Hopefully between now and then (or whenever it happens) we find a way to wirelessly charge things that does not waste 90% of the transmitted power. Maybe some variant of this: [http://en.wikipedia.org/wiki/Magne_Charge](http://en.wikipedia.org/wiki/Magne_Charge). Even a 10% loss is bad, though, and a total waste of power. Every watt counts.

</comment><comment><USER3> I'm hoping that battery capacity improves enough by then that charging will be an afterthought, something we just do on weekends etc. So there wouldn't be such a focus on the charging mechanism (because using it would be such a rare event).</comment>


How McKinsey Lost Its Way in South Africa - <AUTHOR> https://www.nytimes.com/2018/06/26/world/africa/mckinsey-south-africa-eskom.html <comment><USER2> Ok, I find this very problematic - along the lines of 'Hey, our country is massively corrupt and dysfunctional, and these Westerners came in and didn't do really anything really wrong or corrupt, there are other actors who are clearly to blame, but let's blame the Western Colonialists!

This is a bad meme.

First - don't trust McKinsey or any consultants to implement anything unless it's been done before and clear. They're smart people who make slides. Sometimes they have specific knowledge.

Second - it seems as though they were a little aggressive on pricing, who can blame them? It's not their fault - whoever was on the procurement and oversight side on the fence is definitely the guilty/stupid/corrupt party on that one. There doesn't seem to be any indication that McKinsey cheated on that, I mean, literally they are even admitting 'maybe we could have charged less' like a self-aware faux pas? Would we expect that of any business anywhere?

It seemed they knew there was some risk and tried to investigate it legitimately, and then backed away ultimately when things were known. So that's not so bad.

And yet - it looks like there were obvious corrupt actors in this - Gupta's - surprise (!) who where knowingly and specifically trying to screw over the system!

\--> So why isn't this article about the Guptas?

Shouldn't the headline be: "Indian-South African Gupta family swindles South Africa yet again?"

The evidence in the article doesn't really indict McKinsey of anything other than 'knowing maybe they shouldn't have been getting into something risky'. Sure. But they're clearly not the bad guys, and not even 'knowing enablers'.

The problems in this area have little to do with McKinsey.

<comment><USER3> You are totally wrong as another commentator pointed out. Mckinsey knowingly incited and spread racial hatred for their personal gain, and pushed the idea of "white monopoly capital" so that the ANC could leverage that as a political point. The result being highly inflamed racial tensions on their part, not only this but they were paid by Gupta linked companies and organisations. The Gupta's, an Indian billionaire family, have been responsible for corruption of the previous president Zuma, and even had a term 'state-capture' defined to explain what they have done. Through corruption they have literally come to own large state entities, however this was stopped and they and former president are being charged with corruption.

Mckinsey was pivotal in enciting racial tensions, among many other things, to try to obfuscate what the president and Gupta's were responsible for in terms of corrupting the state, by blaming other parties namely "White captial".

<comment><USER4> The "white monopoly capital" was not incited by McKinsey, though.

What happened was that the Gupta brothers and the president received a lot of negative media attention for a series of very serious corruption allegations, so they hired UK-based PR firm Bell Pottinger.

Bell Pottinger spun a story that they were victims of rich white people who spread these stories because their wealth was being threatened. They also hired mobs for protests and ran twitter campaigns.

This did agitate some racial tensions, but fortunately they weren't successful thanks to the dedication of investigative journalists and some heroic whistle blowers.

Here are two relevant links: * [https://www.dailymaverick.co.za/article/2017-06-06-scorpio-a...](https://www.dailymaverick.co.za/article/2017-06-06-scorpio- and-amabhungane-guptaleaks-how-bell-pottinger-sought-to-package-sa-economic- message/) * [https://www.dailymaverick.co.za/article/2017-07-10-analysis-...](https://www.dailymaverick.co.za/article/2017-07-10-analysis- bell-pottinger-has-thought-us-what-to-treasure-in-the-long-painful-haul-back- to-freedom/)

<comment><USER2> Yes - to add, McKinsey does not do corporate communications.

I know some McKinsey types and they are the last people on earth to really grasp populism, field marketing, branding, perception etc..

You don't hire McKinsey to do 'online twitter / Instagram' campaigns.

</comment></comment></comment></comment><comment><USER5> _Also troubling was the fact that McKinsey had won the contract without competitive bidding._

One finds this nugget more than halfway through longish TFA. This really buries the lede. Without a competitive bid process, a public organization is at the mercy of its stupidest and most corrupt officials. When a tiny town in the middle of nowhere wants an abandoned building torn down, they don't call the mayor's cousin. They open an RFP, and the only way the mayor's cousin gets the job is if her bid is the least expensive for the town. Perhaps developing nations can't be expected to have any officials who know how such things should work (!), but every McKinsey employee damn well ought to have known that a giant secret contract is necessarily corrupt.

<comment><USER6> Don't really agree with the idea that everything should be tendered. Tenders are a poor fit for complex situations where the complete path is not clear. To use your analogy: what if the tender included selecting the building to tear down as well as demolishing it? Without further specification, the winner of the tender could have an abnormally low price, be incentivized to pick the easiest building to demolish, and leave the rubble on site because you forgot to define what demolish actually means.

In coding terms: if you can do it waterfall then you can probably tender it, otherwise I'm not so sure.

<comment><USER5> It wasn't an analogy. This literally happens every day. All towns have a process in place for selecting which local hazards to demolish.

Of course for more involved requirements it may be good to break the process into more than one step. It's possible that no one knows what's wrong with the public power utility. If you have to hire McKinsey because corruption, negotiate a simple fee for them to run an actual RFP process for an actual management consulting engagement for you. One of the requirements for that RFP will be that theirs cannot be the only viable bid. If they can't get a bid from another firm that has consulted for publicly-owned utilities, they don't get their RFP fee either.

</comment></comment></comment><comment><USER7> [https://asiancorrespondent.com/2011/10/what-drove-rajat- gupt...](https://asiancorrespondent.com/2011/10/what-drove-rajat-gupta-stray- greed-or-ego/#DP7SyYK1zBOO5bKE.97)

[https://www.cnbc.com/id/41853809](https://www.cnbc.com/id/41853809)

Many McKinsey partners were consumed by greed and exposed during the 2008 banking meltdown and aftermath. This NYT piece is essentially a pr whitewash despite all the details and acceptance of failings. There are plenty of good people lower down at McKinsey but people like Rajat Gupta did a lot of damage to McKinsey's credibility worldwide imo.

<comment><USER8> > _Rajat Gupta did a lot of damage to McKinsey 's credibility worldwide_

This claim is correct, but I think we can reference better sources . The SEC complaint [1] "alleges that, among other things, Rajat K. Gupta tipped his business associate Raj Rajaratnam, Galleon Management's founder and managing general partner, to confidential information Gupta learned in the course of his duties as a member of the Board of Directors of The Goldman Sachs Group, Inc. The complaint alleges that Gupta disclosed material nonpublic information concerning Berkshire Hathaway Inc.'s $5 billion investment in Goldman Sachs in September 2008, and concerning Goldman Sachs's financial results for both the second and the fourth quarter of 2008. Rajaratnam used the information he learned from Gupta to trade profitably in certain Galleon hedge funds" [2]. Somewhat pertinently, Gupta did not violate his responsibilities to Goldman Sachs as a McKinsey officer, but as a GS Board member.

[1] [https://www.sec.gov/litigation/complaints/2011/comp22140.pdf](https://www.sec.gov/litigation/complaints/2011/comp22140.pdf)

[2] [https://www.sec.gov/litigation/litreleases/2012/lr22582.htm](https://www.sec.gov/litigation/litreleases/2012/lr22582.htm)

</comment></comment><comment><USER9> I think the article is relevant in addressing the private sector's partial accountability in the general scene of corruption and exasperation in South Africa.

It is not that McKinsey could be blamed for Eskom's general inefficiencies but rather that it shares responsibility in the lack of a managerial and efficiency turnaround at state companies like Eskom.

The general rhetoric is to blame the government (perhaps correctly), but the present article I think does not attempt to singly shoulder responsibility on McKinsey. It shows how government inefficiency may lead to a general free-for- all or at least a atmosphere of being exempt from justice in the private sector as well.

My summary on the matter would be that many South Africans have the desire to build towards a more economically competent country and that complications in bureaucracy and malevolent actors complicate this. This is a country where anyone rather easily can weaponise different kinds of racism or partiality that degenerates into a debate about whom we should blame. In preventing this particular counter productive and frequent exercise perhaps it is useful to remain as objective as one may be in identifying responsible parties, letting them be held accountable in the corresponding legal framework, and from there focusing on actual problems such as the state of disrepair of Eskom run power stations. It may well be that action by private companies would catalyse the process towards an efficient and economically sound South Africa. However, what this articles shows is how an internationally respected private firm fell into the same traps that local politicians do.

</comment><comment><USER10> My favorite McKinsey failure is the one where UBS (the Swiss Investment Bank) brought them in circa 2000 to understand how they could better expand in the USA. McKinsey said something along the lines of "Well - you guys have very little subprime mortgages exposure and we think this is the next hot thing - you guys need to move all your chips into subprime".

Fast forward 7 to 8 years and the US was hit with one of the biggest financial crises ever. Caused by what? Sub-prime debt. UBS had some of the biggest debt writeoffs - maybe 2nd to Citi.

Source: There is a post-mortem report that UBS released after the financial crises that explains how they got there.

</comment><comment><USER11> Which caste is looting India? [https://www.quora.com/Which-caste-is-looting- India/answer/Ad...](https://www.quora.com/Which-caste-is-looting- India/answer/Adarsh-Sapoota)

</comment><comment><USER12> >Since President Trump took office, McKinsey has greatly expanded consulting for Immigration and Customs Enforcement through that agency's office of "detention, compliance and removals."

Now ICE need the consultants for that! I wonder whether McKinsey had anything to do with that risk assessment software update discussed today?</comment>


The Fatal Ensnaring of Dan DePew - <AUTHOR> https://www.nybooks.com/daily/2019/02/05/the-fatal-ensnaring-of-dan-depew/ <comment><USER2> The age-old takeaway is that if you have abhorrent proclivities, become a cop. You get a wage and the resources to create entire scenarios and then get to play hero to everyone, including yourself. And if it accidentally gets out of hand and goes further than you'd like, you just end up a bigger hero!

One has to wonder if the prevalent stereotype of the creepy pedophile only came about because the socially intelligent ones just go to work at the FBI.

<comment><USER3> That prevalent stereotype exists, because it makes it easier to convict inconvenient people with fabricated evidence.

Need to make a quota? need to sweep some freaks off the street? Smear some hard drives with data and then kick the door down.

Haul the loser fu jour infront of a jury, hold up a plastic baggie, with your HDD prop inside, make up an indefensible story, and explain to the jurors that they don't even want to know what's found on that device.

And all in a day's work. Keeping the streets safe from... ones and zeros on magnetic media.

<comment><USER4> Honestly I would have called bullshit on this before reading the OP, but if everything that journalist is reporting is true, then it's an absolutely terrifying abuse of power by the police.

</comment></comment></comment><comment><USER5> The conclusion is unexpected:

 _No doubt, the two cops who sat around a hotel room trading violent fantasies with DePew and Lambey saw themselves as on the side of social justice. So do all of us rushing to pronounce guilty verdicts on anyone accused of sexual misdeeds now. We, too, have predator quotas to fill. As with the DePew jury or the Meese Commission, for sexual-justice-seeking Twitter mobs, evidence is still optional._

 _Fantasies about perpetrators permeated all levels of Dan DePew's case, and we're never more beset by fantasy than when asserting the purity of our motives. Never more perverse—and punitive—than when trying to prove that it's other people who are the sadists._

<comment><USER6> Not if you take into account that moral outrage has a self-serving component:

> _When people publicly rage about perceived injustices that don 't affect > them personally, we tend to assume this expression is rooted in altruism—a > "disinterested and selfless concern for the well-being of others." But new > research suggests that professing such third-party concern—what social > scientists refer to as "moral outrage"—is often a function of self-interest, > wielded to assuage feelings of personal culpability for societal harms or > reinforce (to the self and others) one's own status as a Very Good Person._

> _Feelings of guilt are a direct threat to one 's sense that they are a moral > person and, accordingly, research on guilt finds that this emotion elicits > strategies aimed at alleviating guilt that do not always involve undoing > one's actions. Furthermore, research shows that individuals respond to > reminders of their group's moral culpability with feelings of outrage at > third-party harm-doing. These findings suggest that feelings of moral > outrage, long thought to be grounded solely in concerns with maintaining > justice, may sometimes reflect efforts to maintain a moral identity._

Emphasis on the "outrage" part, which I presume to be a step or two beyond simply _acknowledging_ that something is unfair and wanting to address it.

[0] [http://reason.com/blog/2017/03/01/moral-outrage-is-self- serv...](http://reason.com/blog/2017/03/01/moral-outrage-is-self-serving)

</comment></comment><comment><AUTHOR> I know the material is ghastly, but it's such a well-written article and takes a bit of a different angle on the story. I found it hard to stop reading.

</comment><comment><USER5> _One hears the term "grooming" more and more—once confined to suspected pedophiles and their prospective victims, now it's applied to any relationship marked by disparities in age or power._

The term is also ubiquitous in sprint planning :/

<comment><USER7> right, I was doing a project at a big finance bank and whenever we had to groom stories one of the British devs was always upset at the term because grooming was something pedophiles do - I hadn't ever noticed the term in context before but afterwards I did.</comment></comment>


What are the challenges facing Chile's next generation of startups? - <AUTHOR> http://andesbeat.com/2012/01/09/hecho-en-chile-25-insights-for-chiles-innovators-under-age-25/

<comment><AUTHOR> We spoke to Chile's next generation of startup thought leaders and they spoke back.. ..what're yours?</comment>


Ask HN: Open Source Hospital or ER Systems - <AUTHOR> Hi all, Are there any open source systems for Hospitals or Emergency rooms or anything related to Health Care management? please share if you know of anything like that. I was searching a bit but i thought let me also ask just in case Thanks<p>Edit:
use case is for a smal ER in my town, might extend further if it would work well, it would be nice if the systems had the chance to connected between the town, but isolation is fine as well, tracking patients, numbers of patients <comment><USER2> [https://www.open-emr.org/](https://www.open-emr.org/)

Previous HN thread you might find interesting: [https://news.ycombinator.com/item?id=16949974](https://news.ycombinator.com/item?id=16949974)

[https://news.ycombinator.com/user?id=exception_e](https://news.ycombinator.com/user?id=exception_e) is the admin of the project

<comment><AUTHOR> thanks for the info, the more of these the better :)

</comment></comment><comment><USER3> HospitalRun: [https://hospitalrun.io/](https://hospitalrun.io/)

Built with the developing world in mind first its features (offline first) and its user experience aren't limited to resource-constrained environments.

<comment><USER4> This is the one I have read a bit about. I don't know how it compares to other systems, but it was designed to be robust and reliable under extremely difficult circumstances, including being usable off-line. I was going to post it if no one else had.

</comment></comment><comment><USER5> If you're looking for EMR software, there's OSCAR:

[https://oscar-emr.com/](https://oscar-emr.com/)

<comment><AUTHOR> thanks i will check it out, should you find anything else please feel free to post :)!

</comment></comment><comment><USER6> OpenEMR. A lot of work is being done on modernizing even more the codebase. LibSodium encryption, U2F support, GeoIP Blocking, Integrated WAF, all 8 (!) HTTP Security Headers, etc. You can already deploy in a single click on AWS and GCP.

I'm going to embed Postfix with Dovecot for extremely secure and encrypted email notifications out of the box next week.

</comment><comment><USER7> GNU Health is a Free/Libre project for health practitioners, health institutions and governments. It provides the functionality of Electronic Medical Record (EMR), Hospital Management (HMIS) and Health Information System (HIS).

[http://health.gnu.org](http://health.gnu.org)

</comment><comment><USER8> What is the use case?

<comment><AUTHOR> I added the edit, but what do you mean use case? did i answer it or is there more to it? let me know, was just looking for something to modernize the work as much as possible and switch away from excel or access that is used at the moment, oh and also paper :)

<comment><USER8> That is helpful but I have some more questions: \- Are you looking for a system to maintain a clinical history for each patient that you see? In this case, you would need an EHR system

\- Are you looking for some sort of practice management system to help with scheduling, billing, registration, etc?

\- Does your ER need a Lab Information Management system?

\- Do you need software to manage bed utilization?

\- Do you need two or more of the systems described above? IS the ER a part of another Health System that would want access to your data? You would likely need an interface engine

\- What are the requirements around Open Source software? In some cases self- hosting a healthcare solution becomes more costly than paying a vendor when it comes to HIPPA compliance

Healthcare has a wide variety of software tools that can be used. What will is the benefit you are hoping to bring to the business by implementing this open source software?

<comment><AUTHOR> Great questions, 1\. yes would be great 2\. if possible 3\. there are not that many cases to be honest thankfully, the place is not that big 4\. not really, this is more of a local thing, i am not from US but imagine if there was a City with people also living in the areas around the city,

sometimes we send doctors to those areas to check on the elderly or even kids, so when i mentioned if the system could distribute in a way or be cloud hosted, it would help with these patients

open source, it would be cheap and as a way of proof of concept, I cant say that we are a 1st world country and the project is also a community effort

this is public health so there is no real need for money making, docs and services are tax paid, but they still suffer from systems in place,

makes tracking patients and previous visits a pain, you dont know alergies or similar things, you need to try and find the records if they have them, sometimes its just on paper :)

hope this helps

<comment><USER8> It sounds like HospitalRun would work for you, someone in another post gave a link to it.

OpenHospital might be another option: [https://sourceforge.net/projects/openhospital/](https://sourceforge.net/projects/openhospital/)

Also NOSHEMR looks interesting [https://noshemr.wordpress.com/live- demonstration/](https://noshemr.wordpress.com/live-demonstration/)</comment></comment></comment></comment></comment>


Mark Zuckerberg covers his camera and audio mic jack - <AUTHOR> https://www.facebook.com/zuck/posts/10102910648972921?comment_id=1051574398253584&comment_tracking=%7B%22tn%22%3A%22R9%22%7D <comment><USER2> I don't get this. If someone gets unauthorized access to your computer's camera, all this prevents is them seeing your face staring into your computer. This doesn't solve the underlying problem of someone getting unauthorized access to your computer. It just solves the problem of someone seeing your face, which is not such a terrible problem to have, at least if you're as handsome as I am.

Just covering up the camera is like putting a bandaid on a small cut when you have internal bleeding.

<comment><USER3> All sorts of people do all sorts of things in their bedrooms that have nothing to do with their face staring into their computers. There have been quite a few instances of livestreamers forgetting to turn off their streams, and accidentally broadcasting themselves naked, or having sex with their partners.

I personally don't have any cameras in my room for this reason, but the risk of capturing something sensitive is quite real.

<comment><USER2> I suppose. The underlying problem is still greater, though, than someone seeing you having sex. Someone getting unauthorized access to your webcam, I'd imagine, has the ability and skill to do much worse than look at you naked (which, on the other hand, would be problematic to me because my body is flabby and unattractive).

Wouldn't a better solution be software-based, or some more advanced hardware (like added network security)?

But this picture is taken at an office, where presumably sex isn't happening, and anything confidential will likely not be in large font on a sheet of paper held up in front of a camera that is presumed inactive.

<comment><USER4> That would cost money, as opposed to 1¢ of tape doing the same job.

<comment><USER2> 1¢ of tape solves the issue of someone gaining unauthorized access to the CEO of Facebook's laptop? I think not.

<comment><USER3> Unauthorized access to the laptop is a very different thing than the user (Mark Zuckerberg, in this case) browsing to a website that utilized a camera API, or accidentally clicking Allow, or being caught by some weakness in the Flash API without realizing it. He's probably also got all sorts of other protections on that laptop, but having an extra $0.01 bit of security never hurts.

I think microphones are more dangerous actually; it's hard to glean much meaningful data from most webcam streams (besides perhaps some less than flattering pictures of the user) but a microphone can pick up all sorts of confidential conversations.

<comment><USER2> I always thought that problem was solved by the little light next to the camera turning on when the camera is on.

And if the light doesn't turn on, it's likely something more problematic is happening.

<comment><USER4> If you can hack someone's camera, you can make it so the camera turns on without turning on the light and letting people know you're watching and listening.

<comment><USER2> That's what I meant by "something more problematic is happening." If a hacker can turn on Mark Zuckerberg's camera without having the light turn on, then there's a big problem, and it needs to be rectified to a greater extent than just covering up the camera.

<comment><USER4> Again with the security is not a 1-fix kind of thing. You put a lot of measures in place to make things secure. This is just one of many security measures that should be in place. The enemy has breached the outer wall, but now we have 3 more inner walls protecting the most important stuff that they also have to breach.

And tape over the mic and webcam aren't really things that can be broken through remotely.

<comment><USER2> This makes sense. I guess I was pointing things out just to point them out.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> He's the CEO of a multibillion dollar company. He's legally required to be paranoid to meet his fiduciary responsibilities.

<comment><AUTHOR> Indeed!

</comment></comment><comment><USER6> The page is now down, here's a reupload of the image Zuckerberg posted:

[http://i.imgur.com/3oNniEh.jpg](http://i.imgur.com/3oNniEh.jpg)

Zoomed in with the covers outlined:

[http://i.imgur.com/laM8qEJ.png](http://i.imgur.com/laM8qEJ.png)

<comment><AUTHOR> The link is working fine, page is not down.

<comment><USER6> Huh, must have to do with my FB session. Still shows as missing from my account but loads fine in incognito.

</comment></comment></comment><comment><USER7> I did that too after the "Snowden Revelations"!

<comment><AUTHOR> I cover it too, perhaps everyone should.

</comment></comment><comment><USER8> Why cover the audio mic jack?

<comment><AUTHOR> Check out the last paragraph here: [https://www.wired.com/2014/03/webcams- mics/](https://www.wired.com/2014/03/webcams-mics/)

<comment><USER9> > Muting the mic won't work, since it's possible for an intruder to unmute it. > Your best defense is probably to insert a dummy plug into the microphone > jack to prevent sound from being picked up by the internal mic. You can > create a dummy plug by simply cutting off the unneeded portion of an old > microphone plug. This won't prevent someone from listening to your > conversations when you need the mic, such as when using Skype, but it will > at least thwart them from using the microphone on their own without you > knowing.

The question stands, why tape the headphone jack? The microphone is not inside the headphone jack.

<comment><USER10> Put a dummy plug in there and seal with tape?

<comment><USER9> But that's not where the microphone is (think about it, a microphone stuck down a port wouldn't work well at all).

<comment><USER3> Right, but having a dummy plug will cause the vast majority of laptops to disable their built-in microphones and instead listen to whatever you plugged in. (In the case of a dummy, this would result in a dead line.)

The idea is to fool the system into having no physical microphone, and even a hacker/malware that compromises the operating system is going to have a hard time dealing with whatever soundcard firmware is responsible for making that switch in the hardware.

</comment></comment></comment></comment></comment></comment><comment><USER11> I don't know why I would care about Zuckerberg in particular doing this, but while we're on the topic, can anyone recommend a decent retractable camera cover for mounting on a laptop?

<comment><USER12> "Nope."

[http://www.bungajungle.com/products/nope](http://www.bungajungle.com/products/nope)

I use these on my work machines, however I suggest placing the magnet combo vertically as opposed to horizontally like in the photo so that it defaults into that position.

[Yes I know I could get thin magnets much cheaper from somewhere else, I give them credit because they were the first one I found when looking for a solution a few years ago]

</comment></comment><comment><USER13> How about this: Mark Zuckerberg poses for picture sitting next to [someone's MacBook] with covered camera and audio jack.

<comment><USER14> That's his office, it's quite known that he sits in the open space with all of the employees, I don't think there are any private offices in Facebook other than finance/payroll and some HR which are private due to regulations.

<comment><USER13> Sure, and none of that means that's his desk or his computer. Unless you have specific knowledge about what he keeps on his desk, this entire thread is a lot of silly speculation based on an unwarranted assumption.

</comment></comment></comment><comment><USER15> yet he used the password "dadada"

<comment><USER16> Is that confirmed? Do you have a source for that? Wow.

<comment><USER17> Just Google it...

</comment></comment></comment><comment><USER18> What benefit would it be using tape over the jack hole? The built in mic I could understand. But, surely it wouldn't work unless something was plugged in? Or is it a reminder to himself and yo prevent him from pluging in headphones with inline microphone? Genuinely curious.

<comment><USER19> On the MacBook that's a combination 3.5mm audio jack and SPDIF port, one that can emit laser light if it's confused about what's plugged in or not.

So it could be to block that light, or to prevent cruft from going into it, or to fight the urge to use headphones at work.

</comment></comment><comment><USER20> Does this make any sense in an open workspace where you're surrounded by a million other laptops and cell phones anyway?

</comment><comment><USER21> He may be doing it to prevent snooping from Corporate spies, hackers, and the like, not just for privacy, even if the reason of privacy is ironic.

<comment><USER22> How is "prevent snooping from Corporate spies, hackers, and the like" not exactly "for privacy"?</comment></comment>


Ask HN: Does it matter to be a Computer Sc. student to enter the industry? - <AUTHOR>

I am not a computer science student. But I am really passionate about coding. A lot of people keep telling me that my academic branch is different from what I like and it will not do me any good. Does it really matter if I am not a computer science student. <comment><USER2> It will do you some good, and may be perfectly fine. I have three thoughts that might help you determine how valuable it is for you:

As an Electrical Engineering student, I find that I also enjoy coding. Developing a program is similar in many ways to developing an embedded system. My experience in the design process helps greatly in both areas, and I feel that I'm just as productive, if not more productive, than my CS counterparts. In fact, I'm currently writing C++ desktop apps in an internship. These apps interface with external hardware, where my EE skills come into play. My education has helped me to do this job, and I'm at least as good at it as someone who had no skill with hardware. If your academic branch is related to design, math, science, or the market you wish to enter, then it's a perfectly fine discipline for you to be in.

If you don't have familiarity with a CS department at your school, you should be aware that computer science in its pure sense is very different from working in a programming industry. You don't necessarily have to touch a keyboard at all to do computer science; it's basically a discipline of mathematics. However, some schools have a CS department which is designed to prepare you for industry, which can't really be called computer science. A traditional CS degree isn't the ideal preparation for entry to industry.

Now, if you were a student in an academic branch completely unrelated to the industry you want to enter, it might be hard to find sufficient value to justify the degree. You'd have to approach it from a "learning how to learn" or "wholistic education" standpoint.

<comment><AUTHOR> Well, this is true, but doesn't passion come first. I know so many coders who did their engineering in arts or commerce or are chemical engineers.

And from all of them, I have learnt one thing, to never give up what you love the most :)

</comment></comment><comment><USER3> In general, no it doesn't really matter at all, especially not if you have a degree in maths or the sciences instead. If you're going for a programming position though it really helps if you can demonstrate other programs you have written.

But please give us more information about what you want to do.

<comment><AUTHOR> I am currently a web developer but doing my Mechanical Engineering.</comment></comment>


The Myth of the Overqualified Worker - <AUTHOR> http://hbr.org/2010/12/the-myth-of-the-overqualified-worker/ar/

<comment><USER2> A: Great article

B: what does his have to do with Google? That they hire people like Peter Norvig once in awhile?

edit: Maybe Google is mentioned on the second page? The OP is from 2010 and so the rest of the content (if any, hard to tell with how it ends) is behind a paywall. But what's shown is still a good read.

However, this was written in 2010. What research has been done since then? I imagine that the situation has not changed much since 2010, and may have become worse in terms of the bias. Would love to see more up-to-date or more comprehensive research and findings on this topic.

\---

This fear of over-qualification speaks a sad truth about the nature of institutions. When asked to think about it, I think most reasonable people would agree with the statement "You should hire the best qualified person and the company should adapt to that person's initiative and ideas"

But that's not how things work. At a very selfish level, people don't want to be shown up. It would take a very altruistic middle manager to hire someone who could push the ship in the right direction, if that pushing threatened the manager's job (as many reorganizations tend to do). Really, the only person who can hire the best without feeling threatened is the CEO, but in bigger companies, they usually aren't involved. And it's the CEO who would have unilateral power to let the overachievers grow, rather than be stifled by the constraints of their department.

<comment><USER3> Google has a reputation for hiring people with stellar qualifications, and putting them in fairly mundane jobs for which they appear overqualified. See here, for example: [http://www.businessinsider.com/google-employees-confess- the-...](http://www.businessinsider.com/google-employees-confess-the-worst- things-about-working-at-google-2013-11)

(Norvig is most certainly not one of these, BTW; he's doing research similar to what he'd be doing in academia, with more resources.)

<comment><USER2> Ah, thanks...As soon as I wrote "Norvig" I immediately regretted it, but he was the first transcends-even-Google person I could think of. Obviously he doesn't count if he's given a high ceiling to reach for (which it seems he has)

</comment></comment></comment><comment><USER4> While it may indeed be possible to ensure positive morale for "over-qualified" individuals through "empowerment" as they say, that very empowerment isn't always realistic, available, or possible. Sometimes it is for a small minority which leads to an ultra-competitive culture among many "over-qualified" folks.

In any event the negative morale that can ensue when many over-qualified people do mundane work is quite detrimental, draining, and contagious. I've experienced it and am happy to now work in a place with a different kind of culture.

It makes sense that HBR which espouses a business school point of view would argue this, because the system _works_ for orgs that use it, at the expense of the drained individuals that burn out. Since there is such an over-supply of talent, it's an employers' market and an outlook like this one can be espoused. We do need to remember that it's not pretty for the folks involved.

The problem of how to employ these folks in empowering jobs, when there are so many of them: not something easily solved.

<comment><USER5> Another word for empowerment is "autonomy" or "slack". If the regular job is easy, let the employee do other things during the slack time, whether it's helping the company or not. If it helps - that's great, and the person should be paid.

Overqualified people are cool if you don't have to manage them - the lack of oversight saves everyone time and money.

Likewise, being overqualified is cool. The work is easy and steady. Probably even more importantly, people who are overqualified for some jobs take the jobs because they're "fun" jobs. My job is basically "fun" except for some of the coworkers (most are very awesome, but you never get 100%). I undertake odd side projects. The pay isn't great, but the benefits are decent, and the hours are pretty good.

I'm looking to make a lateral move that's probably to a differently "fun" job, but one with less autonomy and slack time, and more pay.

</comment></comment><comment><USER6> This isn't really related to the "Google myth" though, is it? I always thought the Google problem was the employees are worried about being replaced, and even the proverbial janitor holds a CS degree and runs an open source project in your subject area on the side.

</comment><comment><USER7> FWIW, the original article has nothing to say at all about Google. The data are interesting, but it is not at all framed the way the HN title suggests.

(Should the title get edited, it was originally: 'Quit putting down Google: "The myth of the overqualified worker"'.)

<comment><USER8> I'm guessing it had something to do with some of the recent episodes in Dilbert:

[http://dilbert.com/fast/2013-12-27/](http://dilbert.com/fast/2013-12-27/)

[http://dilbert.com/fast/2013-12-28/](http://dilbert.com/fast/2013-12-28/)</comment></comment>


Tencent, Alibaba among highest valued global brands; Amazon outstrips Microsoft - <AUTHOR> https://news.alphastreet.com/tencent-alibaba-among-highest-valued-global-brands-amazon-outstrips-microsoft/ <comment><USER2> I'd be interested in the metrics used for 'brand value'... I'd much rather buy something from any local retailer than from Alibaba which is notorious for knockoffs, which would make it appear their brand has a negative value (for me at least) if any.</comment>