Don't! The secret of self-control - <AUTHOR> http://www.newyorker.com/reporting/2009/05/18/090518fa_fact_lehrer?currentPage=all#

<comment><USER3> Does anyone here, like me, really appreciate Feynman's just the fact's style of writing?

Most people describe it as eerily cold, but I love it. Articles like the this one on the other hand, while excellent, bury their valuable information under a lot of fluff. And most people like that kind of writing, but I just find it annoying.

Good article, I just wish it was more direct.

<comment><USER4> Took a lot of self-control just to read through the damn thing!

<comment><USER5> On the other hand, I could use some more self-control to do actual work instead of reading through HN.

</comment></comment></comment><comment><USER6> Radiolab summarized the study in a 15 minute segment, if you lack the self- control to read the entire article :)

[http://blogs.wnyc.org/radiolab/2009/03/09/mischel's-marshmal...](http://blogs.wnyc.org/radiolab/2009/03/09/mischel's-marshmallows/)

</comment><comment><USER7> Of course students who 'sit still' and 'do as their told' do better in an educational system which prioritizes conformity.

The kid who decides to open the drawer to find the toys: that's the guy I want on my team. I'm more than willing to farm out grunt work to the 'successful' high delayers.

<comment><USER8> I agree.

Here are the choices 1) Do as you are told and get another marshmallow 2) Eat as many marshmallows as you want with no punishment. That doesn't seem to be a very hard choice. I personally like the kid that checks to make sure that no one is looking then eats the inside of the Oreo and returns it.

I'm not arguing with the results. I would imagine that on average those that do as they are told and conform do better on average. But I doubt those are the same people that make big discoveries or become successful entrepreneurs.

So what happened to the kid that split the Oreo and returned it? That seems like a much more interesting question.

<comment><USER9> Why would you like his behavior? While clever, isn't the same as having an adult as an employee who looks around to make sure nobody's watching while stealing from you just enough so you won't notice? I wouldn't want somebody like that on my team.

<comment><USER8> _I wouldn't want somebody like that on my team._

I would. Who is he harming by eating the middle of an Oreo? You imply that his solution to the problem is wrong because it's deceptive. But it's the testers and parents that put him in that situation. I definitely wouldn't hold it against the kid. I think the solution is more unique and out of the box than just sitting there waiting and getting all worked up over it.

Recognizing this behavior as clever and out of the box is similar to saying lazy programmers are good programmers. Everyone knows a truly lazy programmer is no good. It's the inclination to do work in a more efficient way that they are really after. So while the kid being potentially deceptive and stealing is bad, his inclinations and temperament may not be.

That being said I imagine I would have been the kid that ate the center of the Oreo and put it back... so I may be biased.

</comment></comment></comment></comment><comment><USER10> I've never had much trouble holding back -- it's pushing myself forward that's the hard part. Any tips on metacogitating my way out of that?

<comment><USER11> If you're not pushing yourself forward what are you doing instead? Perhaps whatever you are doing in place of pushing yourself forward is the marshmallow you need to say no to.

</comment></comment><comment><USER12> This sounds vaguely like the test given to Paul Atreides in Dune, testing to see whether he was Human or an animal.

<comment><USER13> Dune is a ridiculously good book. I never understood why it's relatively obscure. Other then perhaps the fact that I tend to grit my teeth when I hear people talking (or making movies) about it with only superficial understanding.

</comment></comment><comment><USER14> Indian Yoga is teaching us about importance of self-control also people can improve their self control through Yoga. People are getting benefited through yoga for self control from thousand of years. Whole concept of yoga is based upon self-control. This research is simply re-inventing the wheel. People who want to improve self-control should try Yoga for at-least couple of months.

<comment><USER15> Agreed. Additionally, I found meditation was useful for increasing my self- control. Many types of yoga are focused on meditative practices but not all. I think these are just mind tricks (hacks?) and this jives with the research the article presented.

</comment></comment><comment><USER16> Another worldview changing article. I'd love to be a psychologist, but I'm not clever enough. Honestly, these guys are mind hackers. Finding unit tests for the brain.

<comment><USER17> You're looking at some of the most interesting research from one of the most clever guys and then generalizing and saying "these guys are super bright".

The best folks in any field are super bright.

I'm not impressed by 95% of psychologists (but then again, I'm not impressed by 85% of coders...).

<comment><USER18> If I'm not mistaken, the comment you responded to was highly sarcastic.

</comment></comment></comment><comment><USER19> Mischel's team found that they could teach tricks to underperforming kids, who would subsequently perform just as well as the originally patient ones.

Does anyone here have good hacker-relevant tips for self-control?

(For instance: when tackling a large problem, approach it bottom-up by starting with utility functions.)

</comment><comment><USER20> See "A Farewell to Alms" for a really interesting discussion of the rise of low time-preference individuals in medieval England, and the role this played in fomenting the Industrial Revolution.

Short interview with the author here: [http://www.gnxp.com/blog/2007/08/10-questions-for-greg- clark...](http://www.gnxp.com/blog/2007/08/10-questions-for-greg-clark.php)

</comment><comment><USER21> "Once you realize that will power is just a matter of learning how to control your attention and thoughts, you can really begin to increase it."

Ah, one of my favorite four-letter words: "Just".

You _just_ add a second database to the system. You _just_ write the slow parts in C. You _just_ learn how to control your attention and thoughts.

</comment><comment><USER22> For a scientific article two things were lacking: How do they define "successful"? How big is the variance/standard deviation?

<comment><USER23> It's a summary of academic research for the New Yorker. If you want statistics on the results, you'll probably need to consult the research itself, not a popular summary.

<comment><USER24> It would be nice if they gave a link to the research itself. This goes in general for all popular science news.

<comment><USER25> The research spans multiple decades and research groups. It's not like the results are published neatly in a single article.

If you really want to read the primary literature, you've got the name of the researcher and his university. PubMed is your friend.

</comment></comment></comment></comment><comment><USER26> Really interesting. I think that most diets don't work because you're forced into thinking about what you eat (and what you're not supposed to). Perhaps the best diet involves changing your lifestyle so that you're doing things that remove your mind from thinking about eating.

</comment><comment><USER27> Why newspapers are dying: because they could not adapt to the shortened attention spans of modern times and learn to write shorter articles.

It was a little bit interesting, but way, way too long...

</comment><comment><USER28> I wonder if any of the 'Brain Gym' genre of games train this delay gratification? lumosity.com has games targeting attention but they aren't the games mentioned in the article.

<comment><USER29> Executive function is determined largely by the amount of self-directed play before age five. That's why electronic toys and baby videos are generally thought to be harmful.

edit: I don't know much about Brain Gym, but Pamela Paul has a whole chapter in Parenting Inc. comparing the different ECE programs, which might answer your question.

<comment><USER30> Could you define "self-directed play" for those of us who aren't 100% clear on its meaning?

<comment><USER31> Self-directed play is where the child isn't playing according to "rules". Where there's no "right" or "wrong" way to play, and the child is making up their own game/world/etc as they go. Think "Lego" :)

</comment></comment></comment></comment><comment><USER32> Where in the world is it May 18th?

</comment><comment><USER33> That was called the yoga almost 3k years ago. I mean self-control (control of the thoughts and emotions) through behavioral exercises.

<comment><USER23> Yeah. Similarly, a big part of Buddhism is trying to be live mindfully, to avoid doing impulsive things that just lead to greater suffering. It's historically tended to get entangled with contemporary religious ideas as it spread throughout the world (not all Buddhists believe in reincarnation, etc.), but none of those are essential.

</comment></comment><comment><USER34> It's the secret to avoiding procrastination too - if you can't stop mulling over all the other things floating around your head, then don't - <USER2> start_. The other things will be replaced fairly quickly with what you're trying to do, and there you go - you've distracted yourself from your distractions and are now being productive :)</comment>


Does Tesla Really Need a $5 Billion Battery Factory? - <AUTHOR> http://online.wsj.com/news/articles/SB10001424052702304157204579473304005412522?mod=WSJ_hpp_MIDDLENexttoWhatsNewsThird&mg=reno64-wsj

<comment><USER2> I propose this question: Does the U.S. need a $5 billion battery factory?

From growing general consumer electronic consumption to green energy initiatives, and finally to continued innovative advances in science & technology, I would argue yes we do.

</comment><comment><USER3> Link to article without hitting the paywall:

[http://stream.wsj.com/story/latest- headlines/SS-2-63399/SS-2...](http://stream.wsj.com/story/latest- headlines/SS-2-63399/SS-2-497784/)

<comment><USER4> Wtf? That shows about as much of the article as the paywall does.

<comment><USER3> Doh they something changed... when I posted that comment the full article was readable.

</comment></comment></comment><comment><USER5> This link worked for me (no paywall):

[http://on.wsj.com/1hgsASK](http://on.wsj.com/1hgsASK)

Hopefully it works for others

</comment><comment><USER6> I really think HN needs a way to auto-detect sites that have paywalls and ignore those submissions. It's no good if the vast majority of readers can't read it.

</comment><comment><USER7> This link is pretty useless if it is behind a paywall that most of us have no access to.</comment>


You genuinely won't believe why this community wouldn't drink clean water - <AUTHOR> http://www.lostateminor.com/2014/07/04/genuinely-wont-believe-community-wouldnt-drink-clean-water/

<comment><USER2> A great lesson in the risks of assuming that any group of people can/will recognize the inherent problems with their own status quo. I liked the storytelling style of the post as well.</comment>


Ask HN: I don't think I can finish college - <AUTHOR> I've been in and out of college several times over the past ten years, flunking or dropping out each time. I readily admit this is due to my own character flaws: lack of discipline and motivation, anxiety, depression, isolation. I've had a few successes during this time. I was a software development intern at a geoengineering company, I worked full time at a hospital as a surgical tech, I did some software consulting for a couple of local companies, and I won a few scholarships. Last year, I thought I was getting things under control. I sought out a therapist and went back to school full time, receiving A's and B's in my summer and fall classes, though I still struggled with discipline and motivation.
Then, over Christmas break, I had something like a panic attack that caused some health problems. I tried to stay focused on school, but my health issue consumed my thoughts for weeks. I'm slowly getting over it, but now I'm far behind in all my classes, and I'm not optimistic about my ability to get back on track, because I've been in this situation before and haven't fared well.
I think its obvious now that the only way I'm going to survive even the next 5 years is if I somehow change into a completely different person with a completely different personality, and I'm not sure that I'm be able to.
I apologize if this isn't the appropriate forum to post this, but, in the past, I've noticed some commenters have mentioned they've been at similar low points (or worse). I was hoping one of them might share how they lifted themselves out. <comment><USER2> Unless you have some alternative better opportunity then finishing even at just a passing level will probably be worth it in the long run than dropping out completely. At least you will have finished! You know you can do well as you have done well before but everything boils down to whether or not you can perform despite your feelings of anxiety, depression, panic, boredom etc. There is a formal therapy that has been developed around this idea called ACT (Acceptance and Commitment Therapy). The founder of it, Stephen Hayes, wrote a practical book on it titled "Get Out of Your Mind and Into Your Life" which is worth reading. Russ Harris is also a pretty active writer in this area and has several books on the subject. Procrastination-wise Timothy Pychyl's book "Solving the Procrastination Puzzle" is probably the best book on current methods of overcoming procrastination tendencies. Both of these people are professors and actively do research on their respective fields of study to scientifically validate their ideas. Coincidentally enough I just came across a podcast [http://www.myownworstenemy.org](http://www.myownworstenemy.org) that interviewed both of these people in the latest two episodes. Worth a listen. I wish I had these tools when I was struggling with these problems 20 years ago (and still do, I don't think the struggle will ever go away) but I managed to get through and do OK and I believe you can too.

</comment><comment><USER3> Here's how I cope:

Focus on the now. Here you are. Here is the desk you sit at. Here is the keyboard in front of you. All these thoughts that rush endlessly through your head are simply thoughts. They belong to you, but they are not you. You are more than your thoughts. You are a human being.

You can do anything you put your mind to, but you can only do one thing at any one time. It doesn't matter which one you choose. You have permission to do any one of the things you want to do.

I find that the best things for me are those that require my brain to shift to the unspeaking side. The one that can't articulate anything. It watches, it moves. It knows, and it can't express itself in abstract ways. Drawing, doodling, making clay figures.

I don't know if that helps you, but I sincerely hope it does. I don't know if you pray, or if you are receptive to the idea, but I shall pray for you.

Whatever you choose to do, try not to worry about it. Worry doesn't add a single day to your life, and it robs you of the now.

</comment><comment><USER4> Life is what you make of it, you choose what you want to do in it. If college isn't for you, then just go get a software job somewhere. Lots of places will hire you without a degree, it just requires you to prove yourself a little more through past projects or past experience.

Why is finishing college such an important goal for you, and if it really was important to you, then you would find a way to finish it.

It sounds like you just need to figure out somethings and get your priorities straight. Put your mental and physical well being above everything else and get your shit together. :)

You have to think about what completing the task at hand will provide you in the future and use that to further your progress as you go. So if completing your degree brings you a job, or more money, think about how you will use that in the future.

</comment><comment><USER5> It's very important to understand what causes your issues. This will be the part of the answer. Seems that depression is the main problem here, while anxiety, isolation, panic attacks, lack of discipline and motivation are its side effects. Understand what causes your depression and what do you need to improve your state. Ask for help or go to a doctor if you can't figure it out by yourself. Work on removing things that make you depressed from your life. Anyway, health and happiness are more important assets than formal education, and there is no tragedy if you will not finish the college.

</comment><comment><USER6> It is difficult to say what is the most appropriate solution for a person like you only because I cannot seem to get an accurate read on who you are. But I will share some advice that I ran on in school. Your mileage may vary based on your ability to follow through.

1\. Flunking or dropping, lack of discipline and motivation, anxiety, depression, isolation is a sign of of mental instability and needs severe amount of therapy to fix. And since most therapy is like shooting in the dark and hoping you get a hit, I don't _rely_ on it. I just let it work if it can. And if it cannot, oh well. It is okay to finish the race limping on one leg if the other one does not work.

2\. The best way to get through mental instability is by focusing, and my way of focusing is via anger. The healthier way of focusing is looking at the world in a positive light and knowing anything is possible.

3\. Get past your shortcomings. In fact, enjoy your shortcomings. College is an avalanche of challenge, and its biggest gift is that your weaknesses and shortcomings become revealed to you. (Imagine how bad life would be if you accidently thought you were amazing at everything, simply because you were never challenged.)

4\. College is about growing on top of the challenges, learning through the stress, and bonding with community. College is about giving back as much as it is about receiving. College is about having a commmon struggle. Don't be aloof to it all.

5\. A blind person finishes college in one way. A deaf person finishes college in another way. A blind-deaf person finishes college a third way. Likewise, a smart person, social person, nice person, and angry person each have a unique way of finishing college, and there is no right way or wrong way of doing it. I remember Aesop's fable of the sun and wind at this point. Everyone has strengths. College is about finding those strengths and learning to use those strengths. (Every superhero has their own strengths and they each need to leverage it creatively to win.) Don't think that you being this or that way cannot succeed in college. A person like you must succeed or college needs to transform itself to the correct way where a person like you is not deprived of the opportunity at accomplishing it.

6\. There have been times where I too felt that I was too different or weird to do well. I was not. I was perfectly capable. Often times, the assignments I was given was too weird or different. I never thought too much of it, and I realized (in college) I should never ever let it define or qualify who I was.</comment>


WebGL cloud animation - <AUTHOR> http://workshop.chromeexperiments.com/cloudglobe

<comment><USER2> Is it supposed to look... bad? Mine has smeary day-glo textures with green stipple.

Mac 10.8.2, on Safari/Firefox/Chrome.

<comment><USER3> I don't know if we're seeing the same thing or not, but mine looks OK?

Chrome on Windows 7: <http://imgur.com/QeQdQ>

Chrome on OS X Mountain Lion: <http://cl.ly/image/3z3E3v2d3B0e>

If this is what you see, there's nothing wrong with it. You're seeing the "smearing" of the clouds because they're moving - the time graph is at the bottom (not very intuitive at all!).

<comment><USER2> No, mine is definitely super screwed up then.

Edit: <http://grab.by/gkou>

</comment></comment></comment><comment><USER4> Nice work! Looks great.</comment>


Exxon's Climate Concealment - <AUTHOR> http://www.nytimes.com/2015/10/10/opinion/exxons-climate-concealment.html <comment><AUTHOR> The reporting to which the link refers is here:

[http://insideclimatenews.org/content/Exxon-The-Road-Not- Take...](http://insideclimatenews.org/content/Exxon-The-Road-Not-Taken)</comment>


Android is ten years old - <AUTHOR> https://www.blog.google/products/android/celebrating-sweet-decade-android/ <comment><USER2> And since then the AOSP has been hollowed out with a lot of code moving to Google's (closed source) equivalents.

<comment><USER3> Moving code from AOSP to Google Play Services is a direct response to people like the EU saying googles business practices aren't legal.

That code in Play Services they can now license for $$$. Had they not moved it, anyone would be able to use it and not give Google any $$$'s.

Cases like this highlight how the open source business model is broken.

</comment></comment><comment><USER4> Back then I actually posted what is probably the earliest video of Android in action available online: [https://vimeo.com/384481](https://vimeo.com/384481)

<comment><USER5> Ahhh phones with hard keyboards... How I miss them.

</comment></comment><comment><USER6> The fact that they used the N5 for the pre 4.4 OS renders is truly confusing.</comment>


WebGL vinyls music digging - <AUTHOR> http://diggingintohiphop.com/crate-digger/

<comment><USER2> This is awesome, you made this? I got a project about vinyl records, would love to contact you!

<comment><AUTHOR> Yes, no problem, please tell me more about your project @ valentin.ledrapier (at) gmail.com. This was just an experiment but I also have many ideas around this concept.</comment></comment>


Does Venture Capital Put a Timeline on Your Startup and Limit Flexibility - <AUTHOR> https://medium.com/humble-ventures/does-venture-capital-put-a-timeline-on-your-startup-and-limit-flexibility-9535d0442e50 <comment><USER2> Only if you get the wrong firm. My startup got funding from angel investors on very favorable terms, and my friends with VC funding wish they had gone the same route. It seems like VC funding is great when you're ready to grow right away, but definitely limits your options.</comment>


Pay your employees more - <AUTHOR> http://www.newyorker.com/talk/financial/2012/03/26/120326ta_talk_surowiecki

<comment><USER2> The headline here on HN is a bit misleading, the article is really about spending more on your employees in the aggregate (eg. by hiring more of them, spending more on training, etc) than paying individual employees more.

In any case, I know this doesn't count as data but there is a growing number of establishments (retail stores, coffee shops, etc) I just don't go to anymore because I know the lines are going to be overly long due to understaffing.

It is not okay to make customers wait 10+ minutes in line so you can save a handful of multiples of 8 bucks an hour. And if you do this you may well save a tiny bit of money in the short term, but eventually the customers will just go elsewhere and those customers are unlikely to come back for a long time even after you fix the problem.

(tl;dr -- FU, Vons stores in San Diego).

ps. I realize having to wait 10-ish minutes in line for fresh produce and other groceries is the epitome of a first world problem, but I still reserve the right to point it out as a failing business strategy.

<comment><USER3> No, they come right out and say the four case study retail companies pay their employees more: "They pay their employees more; they have more full-time workers and more salespeople on the floor; and they invest more in training them."

<comment><USER2> I'm not saying they said _nothing_ about paying employees more, but that clearly isn't the focus of the article, thus the headline is still very misleading.

</comment></comment></comment><comment><USER4> I don't understand the misleading title. What employees are paid was certainly a small part of the article, but how many employees you have seems to have been the major focus. So how does "Pay your employees more" capture the article's content at all?

<comment><USER5> Well, pedantically, employees is an aggregate term, and higher salary costs (either by higher individual wages or more individual wages) meets the conditions.

Less pedantically: the focus was on more, better trained employees, and more experienced employees. In the later two situations, this generally translates to individuals being better paid -- experienced workers demand higher wages, as to better trained ones. Further, a large number of the faiure examples given were about firing the higher cost employees (experienced, trained ones, and full-time ones) in favor of cheaper ones, again implying that the per- employee wages were dropped as well.

</comment></comment><comment><USER6> This is a classic correlation vs cause... head fake we always see.

All else equal a company should pay its employees a salary which helps them live a meaningful life. But the article doesn't support the title in any way.

Take best buy for example. Does paying their employees more save them from bankruptcy? Of course not.

<comment><USER7> This statement just seems weird to me. So do you think a company should make profits that make it exist in a "meaningful way?"

</comment></comment><comment><USER8> I think in the cases cited in the OP, investing in more employees is probably strongly correlated with knowing how to deploy additional employees at high ROI.

A smartly run business is probably better equipped to get incremental revenue out of more people/investment.

</comment><comment><USER9> A better construction of this recommendation is to pay your employees enough to take the question of pay off the table. It's simply because people who feel even slightly underpaid become unresponsive to every other form of motivation.

However, it's just a specific example of following the classic talent-based management formula:

* Hire good people,

* Give them goals and the resources they need, and

* Get the hell out of their way.

</comment><comment><USER10> In other words, managing by metrics is problematic and there's no substitute for using your brain. It's interesting to juxtapose this with the thread from the other day about The Well Intentioned Commisar:

<http://news.ycombinator.com/item?id=3688198>

Centrally planned governments don't have a monopoly on stupidity.

<comment> guard-of-terra A corporation is centrally planned.

</comment></comment><comment><USER11> It comes down to product.

If your product is in high demand and you have incredible mind share (as the mentioned brands do), revenue will follow. With more revenue you can afford to ramp up your customer service.

This article seems to claim that revenue is directly correlated to payroll costs. So spending more on payroll will somehow magically increase revenue? Then everyone would be doing it. There is a delicate balance.

Lastly, Circuit City failed because they couldn't innovate as fast as other competitors, namely Best Buy, not because they tried, as a last ditch effort, to save money by hiring temp workers.

</comment><comment> guard-of-terra On the other side, if one dollar apples are so bad that you can't bring yourself to eat them, then ten dollar apple is infinitely better as long as you're still eager to buy it.

</comment><comment><USER12> You get what you paid for applies to everything including salaries.

<comment><USER13> > _You get what you paid for applies to everything including salaries._

Hmmm. Lehman's CEO was not exactly underpaid. Nor Freddie Mac. Nor Fannie Mae. Nor GM. Nor Enron. Nor Worldcom. Nor Rich McGinn in his Lucent days.

And that's just the first people that spring to mind in 60 seconds.

<comment><USER5> I'm not sure if you are being snarky or missing forrests for trees (or the other way around). It's probably a complicated multi-variable situation. If I buy a polished turd for 70% again as much as a regular turd, I stil have a turd, albeit a lovingly polished one. The one widely applicable truism is not cancelled out by another: "a fool and his money are soon parted".

Another way of looking: those places all got exactly what they paid for: someone good at manipulating a given set of rules and following strategies to the T, and who brings a fancy name to the table. Too bad they didn't also focus on the "changes behavior when the rules and the strategy don't make sense" too.</comment></comment></comment>


Ask HN: Best Language/Framework for building desktop apps on Windows and Mac - <AUTHOR> If you were hired today to build a brand new app that would run on both Windows and MacOS what language(s) and framework(s) would you choose to build it?<p>Assumption here is that the client is asking for a really rich desktop experience, with offline capability and some other requirements that make building it as a web app not the best option. <comment><USER2> C++ with QT.</comment>


What an intel atom netbook can do with a 1Gb of Ram - <AUTHOR> http://www.youtube.com/watch?v=wGSZs7B7cYM

<comment><USER2> Other than the RAM usage, I'm not that impressed with the CPU usage. It uses about as much as Windows would use.

I actually had to try a bunch of Linux distros for an old Atom netbook with 1 GB of RAM. The one with the lowest resource usage was Zorin OS Lite 7.1 which uses 0-1 percent CPU when doing nothing, or even with the system monitor on, and ~100 MB of RAM. Zorin Lite is based on LXDE/Lubuntu, so I assume Lubuntu uses about as much, but I didn't try it anymore, because I don't really like the default LXDE interface, and I like Zorin's more.

The one with relatively low CPU (5 percent doing nothing( and RAM usage (140 MB) that I liked most was Linux Lite, with its XFCE-based interface. The slightly extra resources it needed were a noticeable a little when trying to open stuff, compared to Zorin Lite, but not a significant slowdown (still much smaller than what I see with Elementary in the video).

I could've lived with that, because I really liked the interface, but unfortunately for some reason it doesn't recognize the keyboard properly, and for some keys, instead of typing the letters on them, it would type the numbers on them. Maybe they can get it fixed with the next version that will be based on 14.04 LTS (they only base it on LTS versions).

Super lightweight distros like Puppy and others that run in RAM are a non- starter for me, because they have really ugly, non-intuitive interfaces, and I actually want to use apps like Chrome and so on.

[http://zorin-os.com/lite.html](http://zorin-os.com/lite.html)

[https://www.linuxliteos.com/](https://www.linuxliteos.com/)

<comment><AUTHOR> Of course the aim is not only "memory or cpu low usage" but also features.

eOS does what Unity or Gnome3 should do but with much less resources.</comment></comment>


Feynman: I love my wife. My wife is dead. - <AUTHOR> http://www.lettersofnote.com/2012/02/i-love-my-wife-my-wife-is-dead.html

<comment><AUTHOR> Reading this simply reminds me that there's nothing more important and precious in life than loving and caring for your near and dear ones!

</comment><comment><USER2> wow that is a very heartfelt letter, I love the slight humor at the very end.</comment>


Kubernetes 1.7: Security Hardening, Stateful Application Updates and Extensibility - <AUTHOR> http://blog.kubernetes.io/2017/06/kubernetes-1.7-security-hardening-stateful-application-extensibility-updates.html <comment><USER2> Kubernetes is getting a number of extensibility features in this release. The net new one is "API Aggregation" which enables the addition/registration of API servers behind the primary API server. And there is sort of a toolkit for building these new API servers emerging[1].

The second major one is "third-party resources" which has now been renamed to custom resource definitions. These power a number of software systems[2] today and the changes are explained in this blog post[3].

[1]: [https://github.com/kubernetes-incubator/apiserver- builder](https://github.com/kubernetes-incubator/apiserver-builder)

[2]: [https://github.com/coreos/awesome-kubernetes- extensions](https://github.com/coreos/awesome-kubernetes-extensions)

[3]: [https://coreos.com/blog/custom-resource- kubernetes-v17](https://coreos.com/blog/custom-resource-kubernetes-v17)

<comment><USER3> "API Aggregation" along with CRDs are going to be huge. It essentially lets people create plugins and Operators more easily, without having to go through the development and release cycle for the core project. That's going to accelerate a lot of innovation. Combined with Helm charts and some discovery mechanism, and it is going to crank things up for Kubernetes even more so than what we've seen in the past year and a half.

I was looking at service-catalog, and I got thinking, wow, K8S rapidly catching up to CloudFoundry. It may not be long before it starts overtaking it.

I still wonder how the pre-container generation of DevOps tools will work with this -- Puppet, Chef, Ansible, etc. It seems to me that all the older- generation devops "infrastructure as code" tooling are one move behind Kubernetes.

<comment><USER4> I wonder if the plan is to eventually split out core controllers into separate modules. For example, the replica set controller could easily be its own thing that ran as a pod; what it does, fundamentally, is ensure that the correct number of pods exists for a specific template.

Kubernetes is, conceptually, MVC. There's a data store of objects that describe what the world should look like, then a bunch of controllers that use this store to continually "converge" and "repair" the world so it looks like the description, plus APIs to perform specific actions such as perform a rollout or undo.

With this new addition, you get closer to erasing the conceptual distinction between "core" Kubernetes and everything else, which is great.

<comment><USER3> I don't know if the core is going to get split. There might not be a reason (overhead with memory, more to supervise). It's kinda like MVC but I think it follows more closely to the control/convergence loop you are talking about (and from there, Promise Theory), whereas MVC don't really have that control loop.

On the other hand, Operators are essentially non-core controllers. They can be highly specialized to a specific system (etcd, kafka, postgresql, etc.) Same with service catalogs.

<comment><USER5> It's likely things will continue to subdivide gracefully, but I don't know how likely we are in the near term to split out the existing apis and controllers. The line will be drawn more strongly for net new things - do it as an extension, not in core.

</comment></comment></comment></comment></comment><comment><USER6> Does Kubernetes support adding "middleware" between it and docker? ie when it comes time to do a container start, it calls my custom plugin instead of docker directly? I read the docs about extensibility and it didn't seem so.

<comment><USER7> What kind of plugins are you thinking of?

<comment><USER6> This is a very simple example. But we require setting the pid limit cgroup. Right now Kubernetes doesn't support this (again, just an example, there are a lot of things kubernetes doesn't support that we need beyond pid limits).

So it'd be nice to be able to proxy the call to docker to inject our own config before hitting docker. It looks like CRI is exactly what we'd need, possibly maintaining our own fork of the docker shim? Trying to figure out if there is a way to put in arbitrary data in the config sent to the docker shim[0]

[0] [https://github.com/kubernetes/kubernetes/blob/master/pkg/kub...](https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/apis/cri/v1alpha1/runtime/api.pb.go)

</comment></comment></comment><comment><USER8> Has the apt repo been updated? `apt-get install kubelet` is still giving me v1.6.6. I'm using `deb [http://apt.kubernetes.io/](http://apt.kubernetes.io/) kubernetes-xenial main` as the apt source.

Edit: I think it's a mistake. Reported here: [https://github.com/kubernetes/release/issues/358](https://github.com/kubernetes/release/issues/358)

</comment><comment><USER9> I just checked Google container engine. It's not available yet in the update list for GCE

<comment><USER10> Kubernetes is a community project, not directly tied to GKE release dates [0]

K8s 1.6 was released on March 28 and GKE made that version available on April 4. I would expect a similar wait time to 1.7.

0 - [https://cloud.google.com/container-engine/release- notes#supp...](https://cloud.google.com/container-engine/release- notes#supported_kubernetes_versions)

<comment><USER11> It may be a little more delayed because of the US 4th of July holiday:

> There will be no release for the week of July 3rd, since this is a holiday > in the US. The next release is planned for the week of July 10th.</comment></comment></comment>


OK, you've convinced me. I'm coming to join you. - <AUTHOR> I'm 36, married with numerous kids, career blub programmer with BigCo, and I've had enough.
Friday I notified my boss I would not be there come March, and this weekend my wife and I started work on our new project (I'd forgotten how well we work together). This gives us six months to prepare our family for life beyond BigCo, and I can't wait.
For the first time in ages I'm relaxed and excited about the future. Thanks to everyone here for the inspiration and big thanks to my awesome wife. <comment><USER2> Age has nothing to do with it. Marital status has nothing to do with it. Smarts has little to do with it.

Don't do it because you're moving away from a job you don't like; that's a bad formula.

Do it because you want it that badly. That's what matters most.

The decision has been made. Good. Don't hestitate. Don't wonder. Don't look back. Don't ever quit.

Use us for encouragement.

Looking forward to hearing about your success.

<comment><USER3> _Looking forward to hearing about your success._

Or your [failure, perseverance]*, and following success :)

</comment></comment><comment><USER4> Congratulations on your decision. I know what you are going through, I did the exact same thing 2 weeks ago. Full time startup starts for me in just 2 days, I cant wait.

I'm sure you know this, but make sure your company is cool with you starting your project right now. Mainly, that you are not under any IP agreements. The worse thing would be if your company catches wind of your work and decides that they want to "own" it.

</comment><comment><USER5> Hey Dude,

I'm 36 too, I have a wife and kid, and I left a boring safe job to work for what I'd describe as a late-stage startup. My wife works a stable job and brings in a better health lan, too. So while I'm not doing something quite as risky as leaving to start my own probject, I do understand the urge to try something a little more thrilling with a higher potential payout.

Truth is, you'd probably be able to get a big boring job again quite easily if you wanted one. The last time I looked for a job, I had two offers within a few weeks and a substantial counteroffer from my (now ex) employer. The market has its ups and downs, sure, but in the end, I doubt it would be all that hard for you to go back to a bigco and blub away if it comes to that. Which I hope it doesn't for you and for me.

It's excellent that you're giving this a try. Good luck. Do you have a blog or anything? Keep us posted!

</comment><comment><USER6> You'll probably fail, make sure you prepare for that. You definitely put to shame the very young single guys who don't want to give up their cozy cube jobs. Good luck!

<comment><AUTHOR> Hence the six months lead time, not 'I quit now!'

I've been without income before and am acutely aware of how much it hurts. I'd like to say I have no plan B, that we _will_ make this work, but I have to be realistic and I'm in no hurry to risk my family's welfare again.

We're doing all we can to minimalise the risk, but there comes a time when you have to be willing to take on some or spend the rest of your life in regret.

I too have a cube job - hence the name :)

</comment></comment><comment><USER7> pg, this is all your fault.

<comment><USER6> #9. Family to support

<http://www.paulgraham.com/notnot.html>

<comment><USER8> Though he did say "I'm not saying it's a bad idea, I'm saying that I don't want to take responsibility for advising it."

PG is wrong when he says "You'll never found the next Google this way", though. IBM was founded by someone who had a wife and kid to support, and had just been convicted of antitrust violations, fired, and had a 1-year jail sentence hanging over his head (later reversed on appeal).

You do need to be hungrier for profits and less willing to trade growth for money. The strategy I'm using (try lots of stuff until I build something useful, then try to get lots of users, then figure out how to monetize it) won't work for someone with a family to support. But the strategy my boss is using (go to your industry contacts, talk to them about their problems, get them to pay you up-front for development while you solve them, reinvest the profits for growth) could work very well.

<comment><USER9> "try lots of stuff until I build something useful, then try to get lots of users, then figure out how to monetize it"

Seriously, would you consider business with anyone who worked like that? Stumbling around blindly for an idea, followed by hoping that you'll generate a set of expenses, and then finally hoping that you'll be able to earn revenues.

I worry more about you than the bloke with the family to support.

<comment><USER8> Consumer web. People don't visit websites based on who developed them. They visit them because they want to.

It's often difficult or impossible to figure out what consumers want, other than putting lots of ideas in front of them. Usually if you ask them, their responses will be wildly different from what they actually do. (I maintained that Reddit was a failure long after I started using it on a regular basis, and did the same with LiveJournal.)

It's not a business model that works in every field - in particular, you absolutely don't want to try enterprise applications this way (really, nobody will buy from you if you try it, as you remark). But it does work.

<comment><USER9> I wasn't intending to imply that people care who developed a website.

But I disagree that you the best approach is to throw things at the wall until you see if something sticks.

<comment><USER10> That's exactly how it works with consumer Internet projects. Consider that even Google didn't realized how valuable what they had was. They tried to sell their search technology in the early days, but only because nobody would buy it, they had to continue running the company on their own. The forumla seems to be:

1\. Build a basic version of something you think people want.

2\. Try it.

3\. If people don't like it, modify and try again. Do that for a few times, and if it still doesn't work. Go back to step 1.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Good Luck!

Thanks for giving us fence sitters another kick in th a$$.

I feel each every post like this is going to push me to the brink and finally make me take the plunge.

Thanks Again.

<comment><AUTHOR> Thanks.

I've been reading ycombinator about six months or so now and discussing ideas with my wife for about as long. It's reached the stage where we decided we may as well actually _do_ something.

Tell you what, though. Gives you a whole different outlook on work when you can see the end in sight.

</comment></comment><comment><USER12> You might want to check how many kids you actually have. Just in case you forget to, you know, _feed_ one or two of them.

</comment><comment><USER13> Congratulations! I know this is a big decision, but working in something that you are passionate about is always great.

Hope it will work just the way you want. Good Luck.

</comment><comment><USER14> Now YOU are the inspiration. Good luck!

</comment><comment><USER15> Good luck. Make sure you build something users want and something that has a business model.

Kids get cranky if you don't feed them :-)

</comment><comment><USER16> If you can get something together by Oct 11 for YC's deadline, you can be demoing to investors in March.

<http://ycombinator.com/w2008.html>

<comment><AUTHOR> I'd love to, but I'm outside the US (Australia)

<comment><USER17> Where in Australia? I'm from Perth and living in NZ (Auckland).

<comment><AUTHOR> I'm from Perth but living in Canberra

</comment></comment></comment></comment><comment><USER18> O boy. Now you got two option. 1-Die trying (and as they say, if you do you won't care anymore) or 2-Become successful. I see you choosing option2.

</comment><comment><USER3> I've been thinking of working on things with people I'm romantically involved with... what's the experience like? What are the ups and downs?

<comment><AUTHOR> You know, I hadn't realised until I read your comment, but our tenth wedding anniversary coincides _very_ nicely with our leaving the BigCo life.

The Downs: You don't always see eye to eye, and you need to be able to work things out.

The Ups: For me, my wife is not IT oriented, so doesn't try to tell me how to do things, but provides very valuable insight into how a normal user would approach things; her ideas are very good. Another point - You know your partner isn't an idiot:)

</comment></comment><comment><USER19> That's fantastic! Congratulations.

</comment><comment><USER20> Come on...which bigco? And which part of the world do you live in?

<comment><AUTHOR> Think massive international co with a tla for a name. Australia.

<comment><USER21> So I guess you know quite a bit about linux then? :) What field is your startup going to be in?

<comment><AUTHOR> > So I guess you know quite a bit about linux then?

No, the _other_ big three letter IT company. Hint: was started by a prior US presidential candidate.

<comment><USER21> Oh rightio, not even I can miss that hint. Yes good idea leaving them, they can be a bit stifling I hear.

</comment></comment></comment></comment></comment><comment><USER22> cubicle67: I'm happy to report there is indeed life beyond the BigCo cubicle.

I made a similar move a few years ago, and haven't regretted.

Good luck.

</comment><comment><USER23> Woot. What are you going to build?

<comment><AUTHOR> Nothing too fancy. We're taking something that's been done hundreds of times before, but all very badly, adding a bit of a twist and making it usable. Our aims are fairly modest, just to generate enough income to support us. I have no (well, not many :) grandiose visions of selling for millions.

</comment></comment><comment><USER24> Man it would be awesome to have a wife that I could work well with, I think.

</comment><comment><USER25> Congrats, keep us posted.

</comment><comment><USER26> Congratulations!

</comment><comment><USER27> way to go man... What is a blurb programmer?

<comment><AUTHOR> kinda like a blub programmer, but with more rrrrr</comment></comment>


Dumb Ideas in Computer Security (2005) - <AUTHOR> http://www.ranum.com/security/computer_security/editorials/dumb/index.html <comment><USER2>
      The most recognizable form in which the "Default Permit"
      dumb idea manifests itself is in firewall rules. [...]
      The opposite of "Default Permit" is "Default Deny" and
      it is a really good idea.

And now you know why everything from version control systems to video conferencing software tunnel things over HTTP!

<comment><USER3> I think there's a significant difference here between inbound and outbound firewalls.

Edit: I think about it like getting into a stadium, only a few entrances with ticket takers, but there are lots of doors that are exit-only.

<comment><USER4> There is an extent to which that's true, but it's still subject to the same consequences. If you block all "incoming" traffic then developers react to it. Apps that need incoming data just maintain a persistent connection to a third party server which passes the incoming data over the open connection.

And the third party server doesn't have any magic logic that couldn't be built into the endpoints, it's effectively just a router to work around the restrictive firewall. But now you have a third party in a position to spy on you or impose censorship.

</comment></comment></comment><comment><USER5> Not the dumbest by any means.

What this idea seems to miss is that most of the value created in computing - not just among professional software developers but also among ordinary users - comes when people do things that the creators hadn't thought of. You could run every program in its own isolated space where it can only touch its own stuff, and this would eliminate a lot of vulnerabilities (we see this today on mobile). But as soon as you want to script your image resizes based on a spreadsheet or whatever, that model breaks down (or else you end up with everything tunneled over the few approved vectors; iphone users dropbox files just so that they can open them on the same phone in a different program). And worse, users end up utterly beholden to the few entities with "real" access.

It's very easy to create a secure computer, by turning it off. But that doesn't help anyone. In the long run, the cure of deny-by-default is worse than the disease.

<comment><USER6> I totally agree. For a long time I had this feeling that improving security is basically killing all fun and joy. When I was learning to code, there was no such thing as Data Execution Prevention on Windows, and you could even access and write to memory of another process. What that meant was interesting and fun things. For instance, you could write programs that totally tweaked software that was poorly written or that you just didn't like. You could make computers do your bidding instead of being locked in the ways of thinking of original software authors. Every single improvement in the field of computer security was, and is, slowly eroding this fun.

Back then I thought about it mostly as killing fun; nowdays I consider it killing of _flexibility_. Computers are increasingly being locked down and dumbed down to prevent users from doing anything the authors don't want them to do. It's especially visible in mobile. I can understand the rationale behind it, that an average Joe needs protection from the heavily complicated magic box in front of him. But for those who understand and know how to use that magic, security means less joy, less flexibility, less power.

<comment><USER7> Indeed, every time I hear advocacy of "safer" languages, formal verification, heavily-constrained runtime environments, etc., it's a rather odd feeling; on one hand I think there are definite advantages (e.g. I don't want government backdoors as much as anyone else advocating strong security), but on the other hand, I can't help but think that the strong security of these systems can often be used _against_ the user. One of the most common examples of this is jailbreaking - which basically wouldn't exist at all if systems were built with strong proofs of security. There are also those who think the problem is at the policy level and strongly secure systems should be strongly advocated anyway, but since there has been _very_ little in the way of laws protecting users' freedom to control the hardware and software they own (and instead the opposite has been happening), often the most practical way to freedom is insecurity. As that famous saying goes, "those who give up freedom for security deserve neither."

 _I can understand the rationale behind it, that an average Joe needs protection from the heavily complicated magic box in front of him. But for those who understand and know how to use that magic, security means less joy, less flexibility, less power._

This might be an issue of societal attitudes - there seems to be much emphasis on systems being "easy to use" without any knowledge, which ultimately leads to systems in which the user has absolutely no control; after all, the easiest system to "use" is one that makes all the decisions for the user. And as users start making fewer decisions because of this automation, the "advanced features" that they would otherwise use get used less, leading to their eventual removal. The decreasing motivation of users to learn about and control their systems causes systems to allow less control (and consequently become easier to "use"), feeding back to decreased motivation of the users in a vicious cycle. The biggest concern is that the developers of the future are the users of today, so the increased "automation"/decreased flexibility feeds them too.

It's hard to find a solution to this, but I think it's one that will need to involve a _huge_ shift in societal attitudes - from "I don't know how to do X but Y will do it for me so I don't care about learning more" to "I don't know X so I'll learn how, then find a way to use Y to do it better".

<comment><USER8> The problem is that learning how to do things is really expensive for many people. I think the fundamental problem isn't user-centered design but lopsided bifurcation in who the users are.

For a product like a recipe/grocery app, I genuinely don't care about abstraction layers it uses below its UI. I just want my wife and I to plan our meals and do our grocery shopping in a time-efficient way. I don't want to run into situations where "it doesn't work" and I have to figure out why.

For a product like gulp.js, vim, or google chrome's layout engine, I really do care about those abstraction because I am trying to build things with them and I expect that I'll run into situations where "it doesn't work" and I have to figure out why. So give me the conceptual tools to do so. If that means source-diving without clear documentation about how to do that spelunking, fine. I'll procrastinate on it and be unhappy, but I'll do it. So starting from that perspective, any improvement on the fixing-things experience is a blessing rather than an irrelevance.

But some things necessarily straddle both. It would be very difficult to fund a hardware manufacturing supply chain for a phone without mass-market appeal. Yet the app ecosystem that produces much of the value of a smartphone requires some ability to do things the phone manufacturer did not anticipate, even if it within a playpen.

<comment><USER9> Another issue is that modern personal computers make it massively easy to hide what it is doing.

The phone before me seems to be idle as best i can tell, but if i fire up a process viewer i see 20+ ongoing tasks.

This in contrast mechanical devices of old that only did the one task they were built to do, and were very "loud" (not just auditory) about when they were doing it.

Heck, recently i found myself wondering about hooking up some kind of audio system to wireshark and play around with having various packet traffic produce various sounds. This after reading about a guy that set up his phone to play certain noises to his hearing aid based on the characteristics of wifi networks encountered when walking around town.

Consider also that we suspect something is up with a car or similar because the steering wheel develops an odd rattle, or some unfamiliar noise is heard when doing certain things.

Never mind the old analog modem handshake where we could tell by experience when we got a bad connection, compared to the modern variant where we have to check some "dashboard" to tell if we are connected at all.

</comment></comment></comment></comment></comment><comment><USER10> #1 I've never understood this as a concept. Why on earth would you first run an FTP server and then block the port it uses?

Sure it helps if someone sneakily installs stuff but that's the reason why so many things are nowadays tunneled via HTTP. Because everything is always blocked.

The point about load balancer whitelisting was a good one.

#2 works only if you choose iOS style environment where a single entity, Apple in that case, decides what to run and what not to run.

Otherwise it falls to the "Cute rabbit" category. E.g: If user gets a mail "Click here to see a cute rabbit!" they will click everything, bypass all security dialogs just so they can see the cute rabbit. And/or they will grow desensitised and click "Yes" on all dialogs. The old UAC dialog in Windows Vista was an excellent example of this. Everyone just automatically clicked yes because it popped up all the time.

#3 is just "Don't write buggy software". Yeah. We wouldn't if we were smart enough.

<comment><USER11> Yeah blocking ports is lame. The worst type of IT guy you can meet it's the "i-wont-open-port-53627-for-your-app-because-those-ports-are-dangerous" asshole.

</comment></comment><comment><USER12> I really don't understand how "3) Penetrate and Patch" is a bad idea. The argument is:

> Your software and systems should be secure by design and should have been > designed with flaw-handling in mind

I'm not sure I would argue that systems that have been hacked were intentionally insecure by design, but that the developers thought it was secure by design but they were just wrong. It seems totally unrealistic to say "just make it secure instead" as the solution, especially when machines are connected to the outside world.

<comment><USER13> I read it as "fixing the symptom" vs. "fixing the underlying problem". Suppose a remote attacker can trigger a buffer overflow by sending a malformed packet to your software. Your response might be to simply patch in a regex that checks for malformed packets, which fixes the immediate problem, but ignores possible deeper issues with memory management, remote access, etc.

</comment></comment><comment><USER14> It seems the author originally published this in 2005; reaching the bottom: "Morrisdale, PA Sept 1, 2005." On the linking page, [http://www.ranum.com/security/computer_security/index.html](http://www.ranum.com/security/computer_security/index.html), it states, "(originally written for certifiedsecuritypro.com)."

Might the submitter have meant to make a point about the predictions made by the author, ten years ago? For example, "My prediction is that the "Hacking is Cool" dumb idea will be a dead idea in the next 10 years."

<comment><USER15> Hacking is no longer cool. It's gone pro. It's now done by organized crime and Government intelligence agencies. These are much tougher opponents than the script kiddies of a decade ago.

<comment><USER16> Perhaps another 10 years from now, rogue AI will be the primary opponent, making the pro hackers of today look like the script kiddies.

<comment><USER15> We're already seeing some automatic exploit discovery. Fuzzing tools plus machine learning turn out to be able to find exploits. That can only get more powerful.

<comment><USER9> Yeah i recall seeing someone posting about an adaptive fuzzer here, that had produced jpeg images and whatsnot when given some rather generic starting parameters.

</comment></comment></comment></comment></comment><comment><USER17> Pretty good ideas, but transition fom current-state to the author's ideas will bring a lot of pain.

#1 - Default Permit - if aliens arrived and hacked all of our systems to enforce "default deny" \- we'd all die within a week. Nothing would work. Game over, civilization. Ask the author if he'd sanction a "default deny" switchover on the systems that control his mom's respirator.

If that sounds like an indictment of status quo, you're right. But how do you handle a skid? Not by turning the wheel full lock in the opposite direction, certainly.

Hard to argue with #2 or #3 but of course alternatives depend greatly on the availability of talent, of which there is precious little. Just getting things to work requires most of our bandwidth.

Now, if I ruled the IT world, my devs would be ex-chemical engineers (a profession that seems adept at understanding dynamic processes) who have world-class comprehension of every layer of my tech stack AND who were provided with unlimited budgets and time, with proper prototyping and other great engineering practices.

#4 - Hacking is cool if in service of a noble goal, just as murder is when fighting an aggressive enemy or burglary is when it uncovers something nefarious. But otherwise, it's just plain B&E.

#5 - Educating users. I think we have another transition issue on our hands - most of today's users are clueless, sure. But tomorrow's will only be on guard against what works today. Maybe the author thinks everyone over a certain age is obsolete, or that only security people know what's best for users. In either case, let's hope the author doesn't attempt to fit their template onto other aspects of society.

#6 - Assuming the author is right, if everyone adopts a wait-and-see approach, who will act as the early adopters whose brains one can pick? Certainly IT has a lot of gratuitous product / idea churn, and cluelessness seems to prevail in a lot of decisions, but I doubt fastidious conservatism will fare any better.

<comment><USER18> At the earlier 2000's there were (black hat) hackers getting rich by selling books. And books that teached how to hack where quite popular.

</comment></comment><comment><USER19> I still prefer to go by the Jargon File's definition of "hacker" \- "A person who enjoys exploring the details of programmable systems and stretching their capabilities, as opposed to most users, who prefer to learn only the minimum necessary." or as defined by (RFC) 1392, the Internet Users' Glossary - "A person who delights in having an intimate understanding of the internal workings of a system, computers and computer networks in particular."

In which case, hacking IS cool.

</comment><comment><USER20> I read this article a few years ago and thoroughly enjoyed it, but I've had trouble solving Default Permit in practice. Does anyone know of a free software operating system that white-lists its software (say by having the white-list be tied to the package manager) without having to do a lot of tinkering/configuring? I know you can do it with certain Linux add-ons that provide mandatory access control like SELinux and grsecurity, but it always seems like they introduce problems that you then have to troubleshoot for hours before your system is usable again. Bonus points for if this distro uses ASLR, W^X, and other countermeasures to avoid violating the security policy through code injection.

<comment><USER21> I don't know of any viable desktop solutions for this issue, but it seems to be how iOS works. Unless you jail break your phone you cannot download or install anything not on the app store (where everything goes through a review boardI believe).

And I haven't heard much about iOS viruses really. Maybe for the jail broken ones?

A quick google search turns up this malware [0] which only works through USB. So the system does seem to be working pretty well all in all. Reducing the attack vectors from everything to direct hardware connections only is a pretty big accomplishment I'd think.

[0] - [http://www.computerworld.com/article/2843764/security0/wirel...](http://www.computerworld.com/article/2843764/security0/wirelurker- ios-virus-usb-malware-itbwcw.html)

<comment><USER22> Yes, you are correct. All ios apps must be code signed by Apple which is pretty stringent in it's reviews. This is why you won't find any apps in the app store attempting to spawn /bin/bash or mimic its functionality.

I believe apple is now requiring all osx apps on the app store be code signed as well.

</comment></comment></comment><comment><USER23> What the author does not seem to grasp is security is fundamentally about managing risk. Consider his statement that "IT executives seem to break down into two categories: the 'early adopters' and the 'pause and thinkers.' Over the course of my career, I've noticed that dramatically fewer of the 'early adopters' build successful, secure, mission-critical systems." His measure of success is on whether or not the the software is secure and not whether or not it fills a valid need.

Consider two divisions within a large company. One is the research and development division and the other is finance. I want the R&D department to be the early adopters and I want them to take risks. They will be the early adopters. On the other hand, I want the finance department to be locked down.

Consider the same logic as applied to the typical startup. A startup that is focusing most of their time and energy on security is probably playing the wrong side of the risk equation. They have more to risk by delaying their product than they do making sure it is locked down. On the flip side, an established company like a bank or insurance company has a lot more to lose and should focus more on security.

<comment><USER24> I think M j Ranum [1] probably has an exceptional understanding of risk.

In fact all of his points - the 6 dumb ideas - are places where he's pointing out that people are widely misinterpreting the risks, and putting their time and effort in the wrong place as a result. Most of the closing paragraphs for each point are suggestions on how to better prioritise your time and effort so you can get on whatever make you money.

And wrt your second paragraph, if we consider most companies, there is a 'default permit' on the network, between the workstations in the finance department, and the r&d department, unless they're in physically separate locations, and often even then. The workstations in the finance dept will almost certainly run any software at all, unless it's caught by the anti-virus (default permit, and enumerating badness). You're right that they should be locked down, but are they?

[1] [http://en.wikipedia.org/wiki/Marcus_J._Ranum](http://en.wikipedia.org/wiki/Marcus_J._Ranum)

</comment></comment><comment><USER25> A sure way to identify someone trying to give you bad security advice is when they only talk about security implementation and nothing about what threat one is trying to defend against.

With out a threat model you can't balance useability with security, and you get rhetoric like "default block" or "its all about educating the user". However, no one actually do strictly follow the rhetoric so what you get is bunch of inconsistency, intrusiveness, and bad security. It also generate a lot of flip flap in security policy, security rules and user manuals, all to the despair of the people who are the users of the system.

</comment><comment><USER26> Also: adding features that expand the range of potential hacking attempts.

I'm looking at you, wireless credit cards and cars with cellular phone connections.

Airgaps are not the be-all and end-all, but they certainly help.

(I have a family member with a car that not only has a cellular phone connection, but has enough things adjustable through the "entertainment console" (instrument panel brightness and length of time before lights shut off, among other things) that I'm pretty sure it's not airgapped. (It may be communicating via a simple protocol, but, although it's better than no security, _it 's not the same thing as an airgap_.) Quite frankly, it scares me. Not so much for me or my family personally, but the potential consequences for society in generally. I can far too easily see someone being assassinated by, say, having the ABS lock the brakes on both left tires and release the brakes on both right tires next time someone is driving down a (non-divided) highway, for instance.)

</comment><comment><USER27> This is generally pretty awful.

The first point about default allow is moot today since nearly all protocols encapsulate all others. HTTP for instance can do anything via web sockets.

In addition, most malware is now "pulled" in via email or web rather than "pushed" via remote attacks. Firewalls are almost obsolescent.

<comment><AUTHOR> Port and protocol are not necessarily the only way to implement whitelisting.

A solution like Little Snitch is a step in the right direction concerning networking in my opinion. Which application is opening the connection is just as important as the destination.

An enterprise version of such a program could allow network admins to set rules for different users and help spot unfamiliar applications that are acting suspiciously.

Firewalls aren't dead, they will just become better at inspecting traffic and classifying applications.

A higher degree of security is achievable, the only question is if customers are actually going to demand well engineered products. Until then companies are going to cut corners in order to out-compete each other.

</comment></comment><comment><USER28> I have an aesthetic fondness for these as anti-patterns, but then there is reality:

My 85-year-old mother allowed some random caller to talk her into giving them administrative access to her Windows XP system. I have convinced her to accept replacement of her system with a chromebook, but now I want to retrieve the photos she had on the always-attached backup media. Zero-tolerance for vulnerabilities would mean destroying all media that touched her compromised system, but I'm going to accept the imperfect assurance of malware scanning and then copy the photo files somewhere she can click to them.

"Less and less is done, until non-action is achieved; when nothing is done, nothing remains to be done." (Tao Te Ching 48; translated by Gia-fu Feng and Jane English).

I ask: is that a state of perfection or of death?

<comment><USER9> Unless there is something madly wrong going on, images etc are "sterile".

<comment><USER28> "Madly going wrong" is historically the case: [https://technet.microsoft.com/en- us/library/security/ms04-02...](https://technet.microsoft.com/en- us/library/security/ms04-028.aspx)

<comment><USER9> Makes one wonder if one should just unplug anything electronic and stick to books...

</comment></comment></comment></comment><comment><USER29> I don't really agree with most of the ideas presented here. Setting your corporate firewall to "default deny" is just security theater, not real security. If a black hat installs malware somewhere, it can just as easily phone home via HTTP as on some random port. Arguably, the security theater of forcing everything on to HTTP actually makes it harder to spot anomalous traffic patterns. Earlier someone might have seen a lot of traffic on port 1234 and said "hmm, that's funny..." but with default deny it's impossible to see anything weird except by doing deep packet inspection.

As another poster here pointed out, hacking has gone pro. Clearly governments and organized crime have gotten into the business. The idea that people are going into hacking because "the media lionizes hackers" (like this blog post suggests) just seems kind of silly now. I think if anything, the media tends to exaggerate how scary most hackers are in order to sell more product.

I agree with the author that we are on a treadmill of patching vulnerabilities while creating new vulnerabilities. We'll never really get anywhere as long as we are on the treadmill. But this post doesn't point out any of the things that would actually help. For example, I think better sandboxing techniques in operating systems would help reduce the number of vulnerabilities. Unmanaged programming languages such as C/C++ are a perennial source of vulnerabilities, as everyone seems to know by now. Although most people don't seem to comment on this, languages with eval() such as Python, Perl, Lisp, SQL and Javascript have their own set of vulnerabilities that come from this construct. If we wanted to, we could get rid of these constructs.

Djikstra famously argued that computer science was not about computers. You could make a pretty good case that computer security is not (primarily) about computers, either. A lot of great hackers like Kevin Mitnick were able to penetrate systems just by calling up a technician and pretending to be someone they were not. Computers have given more power to individuals, but the problem of finding trustworthy individuals for your organization is no different than it was before computers came on the scene. A lot of hacks are really just cases of where too much information was shared with too many people who didn't need to have it, or systems were run with inadequate oversight... neither of which are technical problems.

<comment><USER30> Many in IT then and now think security was the domain of people who managed routers and proxies (also responsible from preventing non-approved use, like too much downloading or reading bad things) and IT minions who install an anti-virus. From the network perspective, they block 'malicious' javascript (impossible!) and bad websites (outsourced of course) and they block all ports and websites they can in a constant struggle against actual business needs.

These people are doing what they can, but it mostly involves buying snake oil because they don't understand software.

The idea of running someone else's code (javascript, flash, macros) on the same box as the confidential data, i.e. the end user box, is completely mad when sandboxing technology is still in its infancy. Letting unverified parsers touch untrusted data is mad too, but confining everything (SELinux style) is too hard for most. But why do we let these parsers talk to the network? Why can't I prevent my android/iOS apps from talking to any site on the internet?

We need a sea change in expectation from users (corporate and individual) that their data won't leave their box without them knowing about it, that it will be authenticated and encrypted in transit, who will demand operating systems support for enforcing this, and demand that their applications are written to expect only limited and mediated access to the network, file system and kernel.

</comment></comment><comment><USER31> An example of what he calls "Enumerating Badness" and "Default Permit" is seen today in web application firewalls (WAFs) that try to block XSS payloads. It conceals the real problem, which is a vulnerability in the web app itself, and it's a tall order to expect the WAF to capture 100% of XSS payloads.

<comment><USER32> Traditional host anti-virus software is another good example of 'enumerating badness'. It's certainly hard to keep-up when you take this approach.

</comment></comment><comment><USER33> >Wouldn't it be more sensible to learn how to design security systems that are hack-proof than to learn how to identify security systems that are dumb?

Part of the way you design hack-proof security systems is by identifying the dumb ways of doing things and then not doing them.

</comment><comment><USER34> It's actually quite easy to make a business that is absolutely secure. You simply turn off all of your computers, fire all of your employees, sell off all your assets and empty your bank accounts. There, now you have a business that's absolutely unhackable.

What this hopefully demonstrates is that security is _never_ the final goal, it's always a proximate goal and will always exist in tension with other goals.

Default Permit: We've all heard stories about dumb corporations where programmers couldn't even install a compiler without filling in a form and waiting a month. Default Deny kills productivity in a workplace because of the 80/20 rule. It's very easy to whitelist the 20% of apps that account for 80% of the usage but nigh impossible to whitelist the 80% of apps that are specific and niche. There was a post a few days ago about some guy working for immigration who figured out how to automate his job with UI scripting. That would have never happened under a Default Deny workplace.

Enumerating Badness: Like he said, this is a specialized version of Default Permit and all the same criticisms apply.

Penetrate and Patch: Building software that is architecturally secure is hard because it often imposes global constraints against your code. Global constraints get harder to implement as you start distributing your team in space and time and as you need to adapt code to changing requirements. Penetrate and Patch works because it allows you to deliver code quicker which is overwhelmingly more important than delivering secure code.

Hacking is cool: That he brings up spammers instantly undermines this argument since there's nothing less cool than spammers, yet spam has grown as fast if not faster than hacking over time. The threat vectors most of concern to companies nowadays are from nation states, organized crime and economic extortionists who could care less how "cool" their job.

Educating users: I remember when GMail started stripping out .exes from emails so we would start sending exes inside of zips. Then GMail started inspecting .zip files so we would change the file extension to .zip2. Then Google started detecting ZIP signatures so we started sending encrypted zip files just so we could email exes to each other. Why? Because emailing exes turned out to be a really, really useful thing to do. Any kind of paternalistic security policy inevitably ends up damaging more productive work than it does protecting against threats.

Action is better than inaction: Tell that to all of the industries that have been disrupted because they didn't stay sufficiently on top of trends. There are pros and cons to being an early adopter vs a late adopter but one is not universally better than the other.

The main point through all of this is that when bad security practices are widespread, it's usually because it's in conflict with some other business goal and there are rational reasons why security lost out. There aren't many silver bullet fixes because if there were, they would have been deployed already.

<comment><USER35> > I remember when GMail started stripping out .exes from emails so we would > start sending exes inside of zips. Then GMail started inspecting .zip files > so we would change the file extension to .zip2. Then Google started > detecting ZIP signatures so we started sending encrypted zip files just so > we could email exes to each other.

I recently emailed a zip file containing an .exe through gmail. Gmail refused to send it when the file extension was .zip, but saw nothing wrong with the same file as a .dat . Has there been a policy change?

</comment></comment><comment><USER36> Mostly good points.

This point, "Unless your system was supposed to be hackable then it shouldn't be hackable." wasn't one of them.</comment>


Hitler's Mein Kampf Seen As Self-Help Guide For India's Business Students - <AUTHOR> http://www.huffingtonpost.com/2009/04/22/hitlers-mein-kampf-seen-a_n_190064.html

<comment><AUTHOR> If they like _Mein Kampf_ , then I enthusiastically recommend Niccolò Machiavelli's _The Prince_.</comment>


Show HN: GPemu – A Chrome App to play SNES games - <AUTHOR> https://chrome.google.com/webstore/detail/gpemu/jhficiigpnhhaojldmanflihieepanbb <comment><USER2> I wish Nintendo and similar companies would release the specs of their old platforms under an open license. I think creating an emulator is a great learning experience. I haven't embarked on emulating hardware yet, but have learned a great deal from the work of others in reverse engineering other interesting projects. I still would buy my old SNES games for the Wii U if Nintendo would make their old SNES games freely available and their old specs.

<comment><USER3> > I wish Nintendo and similar companies would release the specs of their old > platforms under an open license.

It wouldn't really matter at this point. By now, the NES [1] and SNES [2] are already some of the best-publicly-documented systems in the world.

[1]: [http://wiki.nesdev.com/](http://wiki.nesdev.com/)

[2]: [http://wiki.superfamicom.org/](http://wiki.superfamicom.org/)

<comment><USER2> I know that part, I speak for the legal side of it I suppose.</comment></comment></comment>