Denver Police Caught Misusing Databases Got Light Punishments, Report Says - <AUTHOR> http://www.nytimes.com/2016/03/18/us/denver-police-criminal-databases-personal-use.html <comment><USER2> I think the bigger issue (which another article I read on this last week described, but I sadly can't find it right now) is that low punishment for when it's caught means its more likely to happen and not be caught. There were 3 cases reported in 2015, how many went unreported? If the culture is "oh it's fine, just don't be egregious about it" I expect it's happened a lot more than 3 times in the last year.

Do they not maintain proper audit logs? I work for Stack Overflow and I can't look at a user's PII without it being logged in multiple systems, do we have higher internal security than the police department?

<comment><USER3> Imaging how these low-lifes would be treated if these were HIPAA violations.

<comment><USER4> One _could_ argue that they aren't necessarily low-lifes: I'd wager many, many people would abuse such power if they could. Which is why it's more important to place constraints on positions of power, than to hope that we only staff those positions with wholly noble people (who are incredibly few in number, in reality).

The other consideration is that if they were doing so under the threat of HIPAA violations, they may not have abused the information quite so casually. Jealous husband fears a slap on the wrist, he abuses the database. Jealous husband fears jail time, he possibly [hires P.I. / follows his wife / etc.].

I'm not defending them–law enforcement enjoys some protections that are arguably unconstitutional, and as such should be held to a much higher standard–but it's unproductive to examine what would have happened if the penalties were different, while simultaneously assuming that the actors would have made identical decisions based on different criteria.

And the reason that's important brings me back to my first point–built-in constraints are the only way to solve this sort of thing, which is the same reasoning the founders used to try to place constraints on American politicians.

<comment><USER5> > One could argue that they aren't necessarily low-lifes: I'd wager many, many > people would abuse such power if they could.

The fact that there may be more of them does not change that they are low- lifes.

<comment><USER4> Sure, but then we wind up having to broadly categorize most people as low- lifes. Which may be true, but that's all the more reason to construct a system that can survive them, not a system that falls apart when representative human beings are part of it.

</comment></comment></comment></comment></comment><comment><USER6> The buried lede: one of the officers used the information to drive to the victim's house and threaten him, yet received only a written reprimand.

If the situation had been reversed, and that man had driven to a police officer's house to threaten him, I think that man would have been criminally charged or even shot on the spot.

<comment><USER7> That's not the way I read it. I read it that the husband threatened the would- be adulterer, not that the police officer did:

"When a Colorado man thought his wife might be having an affair, he asked a Denver police officer to dig up personal details about the man he suspected. The husband then drove by his house and threatened him, according to a civilian oversight agency's report."

<comment><USER6> > I read it that the husband threatened the would-be adulterer, not that the > police officer did:

You are right; I was wrong.

</comment></comment></comment><comment><USER8> What would be my penalty if I gained access and used the same information they did in exactly the same way? I would certainly be arrested, even if the data was publicly available.

</comment><comment><USER9> The problem with State-run police is that they live under a different set of laws than the rest of us. We need to start treating all equally under the law, rather than having two classes of people: the State-connected, and the commoners.</comment>


Kallithea, a free source code management system supporting Mercurial and Git - <AUTHOR> https://kallithea-scm.org/ <comment><USER2> Being working mostly in python and mercurial we choose it and are using it in production for 1-1/2 years and it's been very good so far.</comment>


NASA to Hold News Conference on Astrobiology Discovery - <AUTHOR> http://www.nasa.gov/centers/ames/news/releases/2010/M10-110.html

<comment><USER2> Perhaps a good moment to re-read this:

Why I Hope the Search for Extraterrestrial Life Finds Nothing: <http://www.nickbostrom.com/extraterrestrial.pdf>

tl;dr: "Because it means life is not incredibly unlikely (after all, it occurred on two planets in our own solar system); ergo what must instead be incredibly unlikely is the ability for life to progress to the point where it can spread across the galaxy (after all, no other life form has contacted us); ergo we are doomed."

<comment><USER3> The other theory being that galaxy-spanning life is incredibly common, it's just that we're too immature/uninteresting to bother coming to visit.

How often do you stop and try to communicate with the queen of a particular anthill?

<comment><USER4> The article mentions this theory, it says that if life is incredibly common, it would only take one civilization to be curious and come visit us.

<comment><USER5> I feel like I'm playing into a cliche by even giving this response, but:

Would we recognize it? Would we even know that it had happened? Consider that if there is a civilization capable of traveling across inter-stellar distances, they very likely have got a _very_ different sort of life-span that people on earth. Because of this, their language (if they have something we would recognize as language) could be dramatically different than ours.

Honestly their brains, or "mechanism of creativity" as I guess you could call it, could be something that we would never be able to communicate with.

There are biochemical reasons why extra-terrestrial life would probably be similar to ours, but I can think of no reason why they would be neurologically or psychologically _anything_ like us.

Think about the ants again. Ants have communications, sure, but it's not language, at least not in the human sense. Ants very probably don't have thoughts, and because they don't have thoughts, they don't have a reason to abstract them to words.

This hasn't prevented ants (or bees) from building incredibly interesting and complicated physical and organizational structures.

We've contacted bees. Do you suppose that they realize it?

</comment></comment></comment></comment><comment><USER6> I keep seeing stories pop up here that NASA has some upcoming announcement, but I never remember to follow up on the announcement day to find out what the hubbub was about. I'm starting to get annoyed that a government agency thinks it needs to save "the big reveal" for a press conference. Why not just make the announcement?

<comment><USER7> That's the contrarianism you are going to pick? A bunch of scientists having a for the general public probably harmless but for the scientists in the field no doubt somewhat exciting announcement?

You are not the target audience. This is a press release. Before the existence of the web you would have never heard about the announcement unless you are a science journalist. (The vast majority of people will never hear about this announcement. Reading HN or other places where this announcement might conceivably pop up is clearly not normal.) You really shouldn't be annoyed about something that is not even directed at you.

</comment></comment><comment><USER8> Likely scenario: they found ancient life forms in lake Vostok, deep below the Antarctic ice.

<http://en.wikipedia.org/wiki/Lake_Vostok>

<comment><USER9> ...or they didn't. :-)

Though I am curious: why are they announcing this via a press conference? It seems as though they would publish a paper to be peer-reviewed or something first.

<comment><USER10> The past track record though on these things seems to indicate though that these press conferences fall more into the very interesting discovery for scientists and those who follow it, rather than ground breaking discovery that hits the front pages in general publications.

Although saying that if something truly ground breaking were discovered it wouldn't surprise me if it were announced in the same way.

</comment></comment></comment><comment><USER11> Considering Streptococcus mitis already survived a period of 3 years on the Moon, and amino acids were found in soil retrieved by the Apollo astronauts, my hopes are high.

edit - source: [http://science.nasa.gov/science-news/science-at- nasa/1998/as...](http://science.nasa.gov/science-news/science-at- nasa/1998/ast01sep98_1/)

</comment><comment><USER12> Jason Kottke looked at the speaker list and thinks it's photosynthesis using arsenic. See this thread: <http://news.ycombinator.com/item?id=1953228>

</comment><comment><USER13> Would the discovery of microbial extraterrestrial life have any significant impact on your life?

<comment><USER14> Yes.

<comment><USER15> wow, I didnt get how 33 people blindly agree and upvote a one-word answer, offering no perspective at all , to a very valid question on how a successful outcome to SETI would influence an average guy's life!! Surely, this is not a open-and-shut question. Let me dampen some spirits who are gleefully waiting to see breaking news of extra-terrestrial life. Think about the budget and investment into this grand objective.Think whether the money invested has/would have a respectable ROI-would it have been better spent on less- glamorous, but more useful ventures like funding projects with more "tangible benefits, and issues", like OLPC. Think of world hunger,lack of access to drinking water. Not glamorous-but plenty of scope to advance technology to change the world we live in. And then think of romanticizing on "Are we alone" , la Jodie Foster,Contact or NASA news conferences.

<comment><USER14> Think of the many other colossal wastes of money. I contemplated more than "yes" but really? "Yes" says enough. The discovery of extraterrestrial life will change my life, and for the better, and who the hell are you to denigrate that? How much money does the world spend on bubble gum? How much money has already been spent tearing Iraq and Afghanistan to smaller pieces this morning? How much money was spent on ad buys on last year's Superbowl?

The world has heaping piles of money. Some minuscule fraction is spent on basic science, and you're all high and mighty about lack of access to drinking water. Give me a break.

You want perspective? It's all around you. If you need it from a one-word answer that succinctly responded to the original question, then I'm afraid you need to look elsewhere.

<comment><USER15> Hey,I didn't mean to denigrate you, or anything like that. If it sounded that way, I am very sorry.

The examples that you quote citing colossal wastage of expenditure, ring quite true.Exactly my point. But really, wasted expenditure is wasted expenditure,plain and simple- There cant be any justification, more so, citing another wasted expenditure. Analogy- how rational would it sound, if a convicted murder says in trial "But I killed just one guy.Go,look at some war- ravaged place in Africa what people get away with".

Actually,I believe basic science encompasses a lot more than astrobiology-Even the issues I pointed out, would stand to gain a lot,from advances in basic sciences, and perhaps need more investment.

Perhaps you feel that discovery of ET life would changed your life for the good- I would completely agree with you, if it could make us humans healthier,welathier, or otherwise more intelligent. Till then, I would wait and watch :-) and... read the next interesting thread on HN!

</comment></comment></comment></comment></comment><comment><USER16> They figured they should talk about their discoveries of life on other planets before Wikileaks says it first

</comment><comment><USER17> Perhaps they've sussed out something about what we should expect to see in extraterrestrial life at the molecular (e.g. DNA) level. The biggest clue is the list of participants. One of them specializes in research on non-standard biology. I'm guessing the announcement will be something along the lines of, "It's life, Jim, but not as we know it", and it's right here on Earth!

</comment><comment><USER18> I'm really hoping to officially hear we're not alone :)

<comment><USER19> Just make sure Will Smith is on alert.

<comment><USER20> He covers the Alien/Robot/Zombie/Steampunk market, so I feel fairly secure.

</comment></comment></comment><comment><USER21> This sounds very much like the plot of Deception Point: <http://en.wikipedia.org/wiki/Deception_Point>

</comment><comment><USER22> mars is the result of an oxygen catastrophe where, unlike the earth, life did not survive.

</comment><comment><USER23> The Andromeda Strain!

</comment><comment><USER24> Maybe they will be announcing that Roswell has some secrets, after all.</comment>


Switzerland's most mysterious man  - <AUTHOR> http://www.kernelmag.com/features/report/4853/switzerlands-most-mysterious-man/ <comment><AUTHOR> Other sources: [http://www.lematin.ch/faits-divers/loyon- rire/story/25650014](http://www.lematin.ch/faits-divers/loyon- rire/story/25650014)

</comment><comment><USER2> _The Swiss police are working to try to make contact with Le Loyon. While he hasn't done anything wrong, they are mindful of the local residents' concerns and wish to deter the mystery man from behaving in such a strange way._

Oh, right. "We'd just like to make contact to ask you to _CONFORM_! You understand of course that you're making the nice, pliant, local residents uncomfortable by demonstrating their _limited perspective_ , causing them to _question their own assumptions_! We can't have that, now can we?"</comment>


Ask HN: Why are british obsessed with tea and "mate"? - <AUTHOR> Any historical significance for this group behavior? <comment><USER2> [https://news.ycombinator.com/item?id=12999365](https://news.ycombinator.com/item?id=12999365)

</comment><comment><USER3> Not all of us are obsessed with 'avin a cuppa mate ;-)

</comment><comment><USER4> 'Mate' as in 'Cheers mate!'? ;-)</comment>


Snapchat Employee Data Leaks Out Following Phishing Attack - <AUTHOR> http://techcrunch.com/2016/02/29/snapchat-employee-data-leaks-out-following-phishing-attack/ <comment><USER3> So this looks like HR or someone from inside snapchat got a phishing email and happily obliged and sent off a bunch of sensitive information without confirming that it should all be shipped over (unsecure) email.

I do work for some higher ed institutions, and almost every year without fail we have seen (and dealt with) successful phish attempts of various staff members... it's usually something small like a credit card number, but it still amazes me how an email that may look "very suspicious" to me doesn't set of a flag for someone else who isn't really thinking about this type of attack.

<comment><USER4> Social engineering attacks will probably be a thorn in security's side for a very long time, if not indefinitely... There's a sort of fundamental disconnect inherent in "Trust the system! It's secure! Except be careful because sometimes something that is not the system will pretend to be the system..."

<comment><USER5> We keep treating falling for phishing emails as a user error. But, perhaps, having our most "official" means of communicating online (email) be a protocol that has no identity verification, no authentication and no encryption, is actually a technical bug, not a human one.

I mean, you would expect that we should at least be able to tell that if you get a email@example.com email in your firstname.lastname@example.com inbox, it actually came from x who works at Snapchat. However, that is (in general), not how email works, for some reason (yes, I know, ancient protocol, tons of stakeholders, identity is hard, but come on...).

<comment><USER6> I thought we had this through SPF. Ie. Your mail server can reject mail if the domain doesn't match spf records in dns.

Maybe it's time to start something like an SPF Everywhere campaign.

<comment><USER5> SPF Everywhere would be a start. But, as currently deployed, at least, SPF is nowhere near enough. I do research in security, and even I often have no clue, when faced with a new corporate email system, whether the email addresses I see can or can't be forged, depending on domain.

Hell, if I get firstname.lastname@example.com on my Gmail inbox, I cannot really tell whether even the @company.com part has been authenticated or not. There isn't even an HTTPS like lock icon or anything, let alone a "Google has verified that this email comes from Amazon.com" assurance.

</comment></comment></comment></comment></comment><comment><USER7> Every company should inform their employees of the email impersonation scams going around.

> In the scam, a criminal mimics a chief executive's email account and directs > an employee to wire money to an overseas bank account. By the time the > company realises it has been duped, the money is gone.

> [This scam] has cost businesses around the globe more than $2bn in little > over two years, according to the US Federal Bureau of Investigation," with > more than 12,000 victims, some of which "have been tricked into sending as > much as $90m to offshore accounts."

[http://www.ft.com/intl/cms/s/0/83b4e9be- db16-11e5-a72f-1e774...](http://www.ft.com/intl/cms/s/0/83b4e9be- db16-11e5-a72f-1e7744c66818.html)

<comment><USER8> I'd go a step further and say it's a failing of management and process at said company if any employee felt that the CEO emailing for payroll information was "normal".

<comment><USER9> Agreed. We setup our bank account to require two signers to approve any wires, and they gave us a Key Fob for two factor authentication for wires.

As the company scales, we may add other people like a CFO to the bank account, but we will always require two people to authorize wire transfers.

</comment></comment></comment><comment><USER10> I manage a small Security team where I work. We have a very good security awareness training program we've built out over the years. I'm biased, of course. I helped build it. We may never solve the human aspect of security entirely. However, we have one thing in particular that works well.

The most effective part of our program is the internal phishing attempts. They aren't annually or quarterly but almost monthly and sometimes weekly. It works very, very well and keeps phishing at the top of everyone's mind. There is nothing quite like teaching someone how easy it is to be caught off guard by showing them how easily someone can be phished and how they took the bait. It disarms them and the ego part of the conversation. It makes it a psychologically safe element of the corporate culture. It changes the conversation from "You're a dummy <3 SecOps" to "It can happen to anybody. In fact it's happened to a number of important and very smart people here. Stop, Look and Think before you click or fill out that form or send that file/information."

It's an interesting part of our security awareness program. In fact, we've built out a small application that sends the phishing email with a remote <img /> to track the email view(see the bait).

We then track them hitting the link through a unique URL (taking the bait), and track the final push of a login button or web-form (swallowing the hook entirely.)

It allows us to track how effective the campaign is and understand who may need some remedial training and of course how we can better improve the security awareness training because if a high percentage take the bait, the security awareness training wasn't effective.

In fact, I sent this article around the office this afternoon and sometime mid-week, plan to send another phishing attempt to see if it helped.

This strategy of course requires an organization to be fairly emotionally intelligent and have the right corporate culture. One of trust and transparency in a psychologically safe environment where people aren't mocked or made fun of but properly educated if they take the bait. I know that this kind of culture may not be the norm.

NOTE: We don't have as much to secure as a SnapChat and we aren't a high profile target. We just figured these things were the bare-minimum things to do to protect our employees and our customers.

<comment><USER11> That's one way to do it. The problem, and that happened to me was writing lol phishing in a reply when it really was the person who sent the information request.

These days I just delete such emails sight unseen. Also I block external images or at least used to just because.

</comment></comment><comment><USER12> > Snapchat isn't being too specific — this is sensitive — but payroll > information could include salary data, social security numbers, bank > details, addresses, emails and other personal ID which, in the hands of the > wrong people, could create headaches for those affected.

The scammers asked for W2 tax forms. They use this to collect your refund. This has happened to dozens of startups in LA, among other businesses, ironically the ones which have HR departments.

</comment><comment><USER13> Once we get past the predictable schadenfreude, it's crazy to think how easily this could happy to, or because even of, any one of us.

Do you think you'd think twice before responding to a mail from your manager asking for information that they had reason to ask for? Would you challenge them to verify themselves over the phone at 11:00 PM, just to be sure no one spoofed their email address?

I bet I wouldn't, and I'm paranoid.

<comment><USER14> But unless you actually break into someone's account, email spoofing should be a solved problem. Sure, you can set the from field to whatever you want, but in a typical company scenario, it will look very different in outlook - <USER2> will actually display the sender's email, and if you try to spoof that, you'll just get rejected at the server.

Now if you ignore that and respond anyway... well, there's not much anyone can do about that.

<comment><USER15> Serious question: what would it look like on a smartphone email client?

<comment><USER14> No idea. Work email doesn't go anywhere close my smartphone.

<comment><USER16> How do you reply to emails at 11pm? ;)

</comment></comment></comment></comment></comment><comment><USER17> Related recent report by Brian Krebs:

[https://krebsonsecurity.com/2016/02/phishers-spoof-ceo- reque...](https://krebsonsecurity.com/2016/02/phishers-spoof-ceo- request-w2-forms/)

</comment><comment><USER18> Sadly these spoofed emails from high ups are becoming all too common.

Shameless plug - if anyone is in need of an open source phishing training solution, I recently launched gophish to great feedback so far, and have a new version being dropped early next week: [https://getgophish.com](https://getgophish.com).

Everyone should have access to training to prevent this as much as possible.

<comment><USER19> Feedback. I can't get much from your screenshots since I can't expand them and they are too small to read anything. I don't know what a "simulated phishing campaign" is, what results I might get out of it, I just don't really understand the whole purpose / process, and you don't any info other than the phrase "simulated phishing campaign" to explain what the thing does. So, I can create simulated phishing email, I can see who opens them. I can do this easily. But we're missing something. What does a simulated phishing email accomplish? What does a user get out of it? What would one look like? When would I send one?...

<comment><USER18> Great feedback, thanks! We're working on a new landing page that hopefully shows this in action a bit more, as well as provides a bit more information on why you might want to use gophish and when.

I'll keep this feedback in mind. Very helpful!

</comment></comment></comment><comment><USER20> Based on recent experiences with the hip new investment company that administer's my employer's 401(k) as well as HR, I wouldn't be surprised if much of the data wasn't even considered confidential by the people handling it.

Minor rant: The 401(k) provider regularly sends a plaintext deposit confirmation email (deposit amount, confirmation number) with each payroll cycle. Any time a change in contribution amount is changed, they send a plaintext email with the new contribution percentage. Occasionally they send plaintext statements containing dividend amounts.

When asked to stop sending these e-mails, the 401(k) administrator replied that it wasn't possible, supposedly due to the way they integrate with they integrate with a 3rd party mail provider. (what?)

</comment><comment><USER21> I previously worked for a large Bank and they had authenticated email using Lotus Notes. While i would not recommend using that, it was nice to see them taking this serious. It was required to use it for every internal communication and actually made it seriously easy to use without knowing much about how it really works.

Its much easier to teach people to access their emails using a particullar application then it is to make them aware for phising attacks which sometimes can be very sophisticated.

While this does not work if you have to receive emails from unknowns, it is a no brainer to use something like this at a comapny level for all online communication. In my opinion not doing so is really careless behaviour especially for a tech company...

<comment><USER22> Microsoft Exchange allows for implementation of S/MIME encryption and signing that more or less "just works." There are some naggles (I've run into people before whose Outlook was S/MIME signing emails to external uses, and my Outlook would be upset about showing them since the external user's cert was signed by some internal CA I didn't trust - if I didn't know what was going on that have lead to a frustrating helpdesk call). But, overall, it's nearly transparent when everything is as it should be.

Unfortunately, outside of the world of these internal corporate email products the situation looks a lot worse. Reliably secure delivery of email to external users is a hard problem and most of the current solutions being used are really, really terrible.

</comment></comment><comment><USER23> I just couldn't believe this story, especially after having read the exact same attack a week back on [http://krebsonsecurity.com/2016/02/phishers-spoof- ceo-reques...](http://krebsonsecurity.com/2016/02/phishers-spoof-ceo- request-w2-forms/) !!!!!

</comment><comment><USER24> If the compromised data somehow becomes public, a class-action suit (a la Sony) is not out of the question. At least Snapchat is trying to get ahead of the problem which undoubtedly helps them in the court of public opinion.

<comment><USER25> The Sony case affected customers, apparently this breach only affects employees. I find it hard to believe the employees would file a class action lawsuit against their own employer.

<comment><USER24> This is incorrect, the Sony case affected employees[1]: "the exposure revealed personal information for an estimated 3,000 former and current Sony employees."

[1] [http://deadline.com/2015/09/sony-hacking-lawsuit- settlement-...](http://deadline.com/2015/09/sony-hacking-lawsuit-settlement- employees-identity-theft-1201513280/)

</comment></comment></comment><comment><USER26> Certainly sounds like a CISO would be a good hire for them.

</comment><comment><USER27> This title could've been editorialized a lot and I'm really glad it wasn't.</comment>


Ask HN: How do you politely decline a project? - <AUTHOR>

I've quoted a project to a client (a nonprofit professional organization). It's a rescue mission - they paid a previous developer a nominal fee to build a web application, and many pieces no longer work due to changes in program language versions on the shared host.
I provided a few options, including leaving things as-is but moving to a different host with versions of the libraries that work with the app, or simply paying my non-profit client hourly rate to fix the problems.
They said my estimate was too high, and now they want to meet to discuss the requirements and cost. I'm not really interested in negotiating my rate on this project because I don't need the work, I'm already charging a lower rate because they are a true nonprofit, and whenever haggling over rates comes up this early, I know that collecting my fee is going to be difficult no matter what I charge.
But I'm also not interested in coming off like an arrogant jerk. So, any advice? Interested to hear how you politely walk away from deals.
[edited for formatting] <comment><USER2> I used to feel like an arrogant jerk when I said no to work, especially if there's a family connection or non-profit involved. At the same time I've admired others who have been able to say no to the same sort of things, wishing I could do the same.

One of my favourite books "Boundaries" helped me learn that it's actually good to be able to say no to some things. I used to feel that if I didn't say yes to everything, that made me a bad person. I would later beat up on myself because when I said yes to too many things, I became burned out and resentful. I highly recommend a copy of that book or something similar (Boundaries is from a Christian perspective, which may turn some people off).

I recently said no to some computer work for a friend of my parents. I think my dad assumed I would do it for him, and stated that I needed to go over and help him. I said "I'm sorry but I don't do consulting work anymore. I only help immediate family with computer related issues". No explanation or rationalization, just a polite but firm statement about what I am willing to do and what I'm not willing to do. I think my dad was a bit miffed (probably because he told his friend he would send his son over to help, saving him some money) but I'd rather have my dad respect me and the boundaries I've set than to try and make him like me all the time.

Do I feel like a jerk anymore? No, not really. I work long hours, have a wife and two children to support, and have projects outside of work that require a commitment. Saying yes to other things takes away from my wife and children, and it depletes me from being able to do my best.

Learning to say no is a skill that you can build. It's not about the phrasing or clever wording, it's learning to demarcate what you are willing and what you are not willing to do. It's also very liberating knowing that you don't have to be overcommitted and stressed out. You have a choice.

</comment><comment><USER3> You don't have to negotiate fees - if you reducing the requirements by the appropriate cost, you aren't haggling over the rate. And while I know the kind of customer you mean, a price sensitive customer isn't necessarily one who won't pay on time. I have a non-profit customer who is very price sensitive, but is one of my most reliable in terms of on-time payment.

If you are set on turning down the work, you can say that you have a minimum project size for first time customers. This isn't uncommon - a lot of people aren't interested in taking on tiny projects from new customers. You have a certain target client/project you are interested in, and changing the requirements won't fit that anymore.

Or you can tell them that quality is very important to you, and you don't recommend that they try to complete the project by cutting some of the requirements. You couldn't in good conscience work on that type of project, and if that is the direction they are going, you will not be a good resource for them. That's not impolite - that's true.

</comment><comment><USER4> "I'm sorry, but these are the rates I offer to non-profit agencies. Please understand that these rates are already much lower than my standard rates and as such, are non-negotiable. If you decide to pursue either of the two solutions we have discussed, contact me and I will be glad to help you at the rate I have given you.

I wish you nothing but the best in the future.

Regards, Name"

Something like that? Honest, polite, but to-the-point.

<comment><USER5> I believe that this method offers another benefit:

That the organization is a nonprofit does not require their team to be pleasant employers. Responding in such a manner as described by atgm allows you to judge their character a bit better. You're being respectful of their needs, but firm in your own. If you get an angry, abusive response, then you know that you made an excellent choice in not choosing to work for them. If you get a polite, understanding response, then perhaps you can bend your rates slightly, as they may be a better customer than you initially believed.

</comment></comment><comment><USER6> Stick to your guns and refuse to re-negotiate your rates. That's not being arrogant (regardless of whether it's a non-profit, or a Fortune 500 company you're doing the work for). Your rates are your rates, and if they trot out the "Johnny the neighbor's kid who'll do it for $50" line, you're better off without them as a client. I'd say they're being arrogant for trying to "discuss" the cost.

</comment><comment><USER7> My suggestion is, in the future, always ask for more than you think you can get up front. That way if they want to negotiate you can knock a little off and not worry about it. You might want to read a book on negotiations. I suggest "Secrets of power negotiators.

One very humble approach might be to say... "I am not a good negotiator and i have already give you my bottom line price."

In regards to not coming off like an arrogant jerk... you can't control how people perceive you. If they are saying things and you feel like an arrogant jerk, you're probably being manipulated and might be interested in reading a book about assertiveness like "When I say no, I feel guilty"... which says when people in business relationships criticize you, you should obliquely agree and reassert what you want... "I see how I might be coming off like an arrogant jerk, but I'm still not interested in lowering my rate."

<comment><AUTHOR> These are great suggestions. I've read the first title you suggested, but the second intrigues me. In this situation we're just a little beyond both of these. I'm just interested in the advice of the community and how others handle these situations.

</comment></comment><comment><USER8> Another angle would be to go to the meeting to discuss scope, under the condition that he pays for your time at your stated rate. This drives home the point that your fees are non-negotiable, while still listening to what he has to say.

I deal daily with program managers who specialize in getting you to the table with a legitimate request, then pull you into a weakened position after you said an initial "yes".

"Discuss requirements" - who could oppose to that? He can easily make the point that the main reason for the large cost is that he had a much smaller scope in head. He might not understand that the project is larger than he thinks due to dependencies. At worst, he might not care.

Listen to what he has to say, take a cool-off period, double-check yourself to see whether you're being pulled in something that might turn sour, and provide a revised quote.

</comment><comment><USER9> The graceful way to decline is to promptly send a written proposal reflecting the quoted rate. Personally, I would include a healthy retainer to be applied against final invoice and call it a day.

Most of the time, these things are fishing expeditions. They are either willing to pay and just trying to get the upper hand, or they are going to shop your price around and go with the lowest bidder. Either way, putting your proposal in writing means that they will be the one's who decline, not you.

"Non-profit" does not mean charity, and a professional organization's members typically don't provide discounts to hackers. Once you discounted your rates you put the value of your time on par with the person who accepted "a nominal fee" for the previous work.

<comment><AUTHOR> There's a lot of truth to what you're saying and I appreciate the feedback. I do, however, believe in providing discounts to non-profits, educational institutions, and charities, and while that may mean that I'm a bit of a sucker, I can live with myself because I like to see those places succeed.

The entity we're talking about here is a true non-profit organization, and the problem we're running into is that they want to know how much it's going to cost, and I can't tell them because frankly, I charge by the hour and I don't know what kinds of bugs are going to show up when I fix the ones we know about.

So that makes it a little harder to write up the SoW. But that's a whole other topic. :)

<comment><USER9> Making one's services affordable isn't being a sucker in my book...I've done work _pro bono_ at times. The issue I see is that they are not valuing your time - meeting to negotiate your rate is disrespectful of your time. If they have a budget, then they should tell you what it is so you're not playing twenty questions. If they don't have a budget to share with you, then again they are being disrespectful of your time.

After a bit of sleep, I would recommend offering migration to a compatible sever as the only option and provide an hourly-not-to-exceed proposal with a healthy retainer. The retainer should be the minimum due under the contract (in other words, it's a flat rate if you wrap the project up in a few hours). Hourly-not-to-exceed work is helpful because it provides meaningful feedback on one's estimating skills.

Rewriting the application will almost inevitably entail feature creep (which may be an actual goal). Providing an initial proposal which migrates to a new server allows you to negotiate if a rewrite and new features are really what they really want.

</comment></comment></comment><comment><USER10> If you are not comfortable just saying "not interested" (which gets much easier after the first time), say that you have picked up another long term project, which requires your full attention. If they keep insisting and saying it would only take 5 minutes of your time, counter with "I don't want to get involved in something that I cannot dedicate enough attention to". If they keep further insisting, then they are either dumb and not getting the hints or they want to take advantage of you. In either case the next thing to say - "not interested, bye".

Don't fret, just say how it is. Start politely and escalate as needed.

</comment><comment><USER11> negotiate scope, not rates. its likely that they're in the mess they're in because they went bargain hunting.

</comment><comment><USER12> Write a nice letter thanking them for the opportunity and refer them to someone else. Don't offer an excuse, just say you've decided to pass on the project.

</comment><comment><USER13> No is a powerful tool use it often.</comment>


Ask YC: Gap year ideas? - <AUTHOR>

I am graduating high school early and am looking for cool ways to spend my time before college. I am looking to do some combination work/intern, travel and educational programs. What activities do you think I can get the most out of during a gap year? <comment><USER2> After high school and before college, I spent half of a year in Beijing learning Chinese and the other half in Palo Alto working at a Web startup. (It sounds like a cliché now.) This was three years ago. I'm really glad I did what I did, but there were many things I learned during and afterward that would have helped me a lot. A lot of my friends who deferred college for a year don't consider it a good choice, so it's not a given that you will enjoy it.

My recommendations:

\- Leave home.

\- Spend only your own money. Don't ask or let your parents pay for a single cent. If possible. (But stay on their health insurance.)

\- Make your own plans. If you're traveling, don't sign up for "packages" offered by American (or whatever your home country is) tour companies. Get an airline ticket on your own and correspond with local tour agencies, local universities, etc., on your own.

\- If you have to spend your parents' money or get your plans approved by them, then do your best to persuade them to give you as much freedom as possible, and take as little money as you need.

\- Embrace your freedom. If you're traveling, don't overplan. Leave room to take a trip to another city with people you meet or to abruptly decide you want to go somewhere else or do something else.

\- If you're looking for a job, people will try to take advantage of you. Don't underestimate the value you provide. Don't sell yourself short.

\- Asia is cheap, safe, and fun. South America, Africa, and the Middle East aren't safe. Europe and Australia aren't cheap. And the US isn't quite as fun (for people who grew up there like me). Those generalizations are what led me to go to China, and I think they still hold (relatively) true.

I see from your post history that you don't program. If you're interested in the tech (and tech business) world, which I think you are, then you will be missing out on 99% of it unless you learn to program. I would recommend you figure out what environment would be most conducive to you learning to program, and then put yourself in that environment for the next 10 months. It's that important. Then travel or something for the next two months.

My email is in my profile.

</comment><comment><USER3> You didn't mention where you are from, you might be able to mix a few of these things together. If you're from the US, how about work/intern at a start-up (assuming you're into that since you're on HN) in Europe or Asia?

There are 'working holiday visas' which will allow you to work while you are traveling in certain countries.

</comment><comment><USER4> Start off by looking into where your future college will matriculate credit from. If you're going to school, you absolutely don't want to waste any more time/money than necessary in your general requirements. Most 100/200 level classes in university don't offer you much intellectual bang for your buck. If you could do one semester of community college and one summer term for $5,000 total and knock out 3-4 semesters of high priced boredom inducing garbage general requirement classes, you've got to look into it.

Travel's good and builds the hell out of your wisdom and character. You'll get lots of great business ideas from traveling too. There's two schools of thought: Spend less time (4 days to a week) in a bunch of countries to see which you like and see the major attractions, or spend more time in one or two places going for immersion to really deeply learn about the place. I've done both - I "quick travel" through parts of the world that I'm not sure if I'll like (rapidly did most of Europe), and went for more immersion in China and Spain. Japan I passed through on the way to China and fell in love with it, and have been back a number of times.

If you travel, I'd say think about picking up some skills instead of just doing tourist stuff. Tourist stuff gets boring. Learning another language, a martial art, or some kind of craft that's big locally could be great times.

Working is good, and I know internships aren't such a popular idea on HN, but I interned at my local statehouse for a while between semesters at university and it was blast. Seeing how government really runs to some extent was pretty eye-opening. (It's even more corrupt than you'd expect, but everyone's really nice and friendly)

What I'd recommend against: Staying in your home area without a really filled schedule. Because all of your free time is likely to be sunk into whatever you currently do to waste time (so... maybe XBox and Hacker News? Just guessin'). No matter how much you tell yourself you'll read a ton of books, plant trees, go jogging 10 miles a day - you probably won't if you stay on your home turf. You're likely to read more books, jog more, and plant more trees in foreign countries, at least in my experience. If you do decide to stick around wherever you're at, I'd say almost overschedule yourself - some of the most fun I ever had (in retrospect) was when I was running a company full time out of Boston, building a startup in NYC, taking full time courses in project management, and sometimes traveling for work on the weekends to other cities in North America. Maybe 100 hours of my life were booked from the start of the week, but I still had plenty of free time.

For whatever reason, being busy always seemed to mean I had more free time: Anyone I wanted to see would always work hard to schedule me into the limited time I had available because I was so scarce, I was never bored, and I realized how precious my own time was so I did plenty of gym-going and reading too. Great times.

</comment><comment><USER5> WWOOFing</comment>


Haml 4.0 has been released - <AUTHOR> http://blog.haml.info/post/42998475354/haml-4-0-has-been-released

<comment><USER2> A big thanks to @compay for stepping forward as the new maintainer!</comment>


Caring for Pets Left Behind by the Rapture - <AUTHOR> http://www.businessweek.com/magazine/content/10_08/b4167070046047.htm

<comment><USER2> You don't have to be an atheist to not buy the Rapture. You could be agnostic, Jewish, Hindu or indeed (like me) Christian. Please remember that Camping and his like are a tiny crazy fringe on the edge of a tiny crazy fringe.

</comment><comment><USER3> Are atheists going to stay on earth, or just go to hell? If it's the former, an earth with no fundamentalists sounds like my idea of heaven...

<comment><USER4> From my understanding of "good," a lot of atheists will be taken and a lot of fundamentalists are going to get left behind.

<comment><USER5> That would be a heck of a surprise for a "good" atheist to wake up to.

<comment><USER4> What would he say? "HA! Fooled You!"

</comment></comment></comment></comment><comment><USER6> Forget the "rapture" - instead I would just love a respected service that guaranteed to look after my pets if I got hit by a bus, etc.

So maybe a spoof business like this could be turned into a really good thing?

</comment><comment><USER7> It would be especially interesting if this was in the form of an auction. Based on the eventual price we could gauge belief in the rapture.

Extra points for figuring out how to extend this to other aspects of religion since (I think) the rapture is somewhat fringe. The challenge is coming up with something where both parties actually have the ability to collect upon showing their belief is the correct one.

</comment><comment><USER8> Every time I see this, I can't decide whether to cackle in sadistic delight, or grimace in empathetic disgust. It's quite a workout for my face.

<comment><USER4> [http://www.youtube.com/watch?v=vdEOB8Uv3UY&NR=1](http://www.youtube.com/watch?v=vdEOB8Uv3UY&NR=1)

</comment></comment><comment><USER9> Perhaps some enterprising fundamentalist Christian will start offering a similar service for the pets of nerds after the Singularity? (Uploading cats might be a bit risky).

</comment><comment><USER10> Although this trips a few ethical flags for me (should we be taking advantage of the deluded?) I kind of love it. It makes me wonder if there are other services atheists are particularly suited to offering to fundamentalists.

<comment><USER11> It's only an service for a tiny subset of fundamentalists. While all dispensational premillenialists and members of the small Millerite sect are fundamentalists, not all fundamentalists are advocates of Millerism.

<http://en.wikipedia.org/wiki/Millerism>

<comment><USER12> If you want to link it probably would have been better to use <http://en.wikipedia.org/wiki/Rapture>

Miller was a date setter, but not an advocate of the traditional fundamentalist 'rapture'. He was waiting for the second coming which would have been very public and would have taken the righteous up to heaven before Armageddon/judgement.

<comment><USER11> I'd grant that to the extent that the modern followers of Harold Camping, et. al. are not Millerites, but Camping and his contemporary date-setters are definitely influenced by Miller.

<comment><USER10> And all are deeply influenced by The Crazy.

</comment></comment></comment></comment></comment><comment><USER13> This puts "make something people want" on a whole new level.

<comment><USER14> Isn't "Make something people believe they need, even if you don't believe they need it" as old as the road to Rome?

</comment></comment><comment><USER15> This could be extended... not everyone who believes in the Rapture will be taken (due to the many potential disqualifying clauses)... what about that adulterous, shrimp-eating brother-in-law... surely your mother-in-law would want him cared for in a land of unbelievers, non?

<comment><USER16> A supermajority of the population cares more about the suffering of cute animals than the suffering of adult humans.

</comment></comment><comment><USER4> If an intellectual/conceptual framework has bad income demographics, it's time to question the wisdom of adhering to it. (Which is also not to say that a high average income is any kind of validation. It's not!)

However, if an heretofore obscure genre of music has bad income demographics, it might be a good choice to go long on it. (Blues, Country, various roots musics, etc... Also, if the genre has already achieved mainstream sales, go short!)

</comment><comment><USER17> This is essentially a variation on the "post-rapture post office service", like this one, also run by a non-believer:

<http://www.postrapturepost.com/about.html>

There are several others.</comment>


Ask HN: Need a lawyer for my startup (and no, we don't want VC money)  - <AUTHOR>

I'm currently working on a side project with a partner and we've reached a point where we feel we need to incorporate.  Any recommendations for lawyers?  I've searched all the threads and spoken with 4 different supposedly "startup" lawyers, but so far, every one of them is really only setup to incorporate us as a Delaware corp so that we can raise VC investment.  We have no intentions of seeing outside funding and since we are in CA figured it would be easier and cheaper to setup as a CA corp.
Also, in my conversations with lawyers so far, they'll all charge a flat fee to incorporate.  This fee ranges from $1800 to $5000, which will be our largest expense by a very wide margin.  I'm sure many of the folks on this site have been in the same situation, so looking for any advice or recommendations.
Sorry for the "anon" user account, but since I'm in active discussions with lawyers that I've found through this site, didn't want to create an awkward situation.
Thanks! <comment><USER2> I just used uslegal.com , only cost around $400 I think.

<comment><AUTHOR> Thanks. From what I've heard so far, legalzoom and sites like it are great for solopreneurs, but if you have more than 1 person and want to have ownership vest, assign IP, potentially hire others, then you really can't use one of those services. What was your situation? Was it just you or do you have other founders?</comment></comment>


Ask HN: Best way to find an apprenticeship? - <AUTHOR> Hi HN,
The value of an apprenticeship cannot be overstated. As a student myself, I'm currently searching for a summer opportunity where I can absorb as much as possible.
If someone asked you for an apprenticeship, how would you want them to approach you?
I'm particularly interested in engineering, AI, and design.
Thank you -- I can use all the advice I can get. <comment><USER2> It sounds like you're looking for an internship (8-12 weeks, between semesters) rather than an apprenticeship (often multi-year).

The three fields you're particularly interested in are pretty different. For each of the three, what are you doing right now, that demonstrates to a potential intern host that (i) you are motivated to improve in that area, (ii) you might be able contribute something of value during your internship, (iii) you might be a good future permanent hire in that area?

</comment><comment><USER3> 8th Light offers an apprenticeship (multiple months of paid learning): [https://8thlight.com/apprenticeship/](https://8thlight.com/apprenticeship/)

So does Pillar Technology: [https://pillartechnology.com/dist/assets/careers/pillar- appr...](https://pillartechnology.com/dist/assets/careers/pillar- apprenticeship-program.pdf)

<comment><USER4> Thoughtbot: [https://thoughtbot.com/playbook/our- company/apprenticeship](https://thoughtbot.com/playbook/our- company/apprenticeship)

Most of these seem web based, I wonder if there's any out there for low level / systems.

Edit: IBM: [https://careers.ibm.com/ShowJob/Id/185175/Software- Engineer-...](https://careers.ibm.com/ShowJob/Id/185175/Software-Engineer- Apprenticeship/)</comment></comment>


The Trouble with CodeSchool - <AUTHOR> https://medium.com/i-m-h-o/56ed7faaad58

<comment><USER2> > To truly master the art of programming, we must learn the techniques > available to us, not just the tools. Data structures, algorithms, design > patterns, and computer science concepts are what I'm talking about here.

Exactly how are those _techniques_ not tools of their own? A binary tree is a tool just like a language or a framework is. A quick sort or a merge sort is just another tool - hell, if I'm using a modern language, I can quite easily get any number of sorts in libraries. And what do I gain from learning the implementation details? Divide and conquer algorithms and recursion are wonderful, but simply saying "learn QuickSort" is emphasizing the wrong things.

I'm biased. I'm 19 and never took a formal CS course. I've self-taught myself some of these concepts - not all (bit twiddling is still a mystery to me). But the best programming learning happens organically. I learned how trees worked not out of a book, but because I needed to implement a parent-child relationship in a note-taking app I built. I learned recursion by learning how to do elegant functional programming in JavaScript to simplify my code.

This is how learning happens. You code. You realize your code sucks. You learn to code better. You realize you don't know how to implement something. You learn all you can about it, then you implement it.

Learn concepts because they're practical, not because they're on a list of Shit You Need to Know For Your Whiteboarding Interview. Every single one of the concepts on that list has practical applications, but there's no reason to memorize them and know them by heart unless you plan to use all of them tomorrow.

Otherwise, you're just falling into the same trap you do using a site like CodeSchool: missing the bigger picture of hacking. You're here to build. Learn what you need to do that.

<comment><USER3> The problem is without learning the fundamentals, you don't know what you don't know.

I'm 29, I taught myself to program with no formal education and I've been doing it since I made games for my calculator in 8th grade.

However, I'm going back to school for a CS degree (I already had 90 hours of a history degree), and I constantly run into new stuff in my theory classes that would've saved me a lot of time on past projects.

Learning just the practical stuff that you need right now is fine if you just want to hack something together. But know that if you do it that way you'll have gaps in your knowledge that you didn't even know were there until they bite you in the ass.

<comment><USER4> While I agree with you I think its equally, and if not more important to have a broad high level knowledge of topics.

I taught myself recursion, threading, bit manipulation, design patterns etc as I needed them. I knew what problems they solved at a high level and only learnt the implementation when I needed to.

For example, I only knew about where you _might_ use the decorator pattern before I had a programming test for a job which required you to "create a plugin system". A few hours learning how to actually apply it and I was good to go.

Also if you surround yourself with people smarter than you, you always have someone to point you in the right direction.

This is why I love HN, even though my background is engineering. I get a high level understanding on marketing, design, sales, hireing, product development etc etc

Its cliché, but "learning how to learn" is whats important to me.

</comment></comment></comment><comment><USER5> I've spent the last 3 1/2 years working on a computer science degree from Stanford. In the past year, I cannot think of a time my understanding of the concepts mentioned in the article provided me a particular advantage in my programming work. That time includes a research position, an internship at VMware, an internship at Nicira (bought by VMWare), a self-initiated Unix course, a TAship in networking and a few quarters teaching introductory computer science in the CS 198 program.

I found this article intentionally contrarian for no useful purpose. Gayle, the founder of Career Cup cited at the end, runs a business grooming programmers to work at large companies (see her book 'The Google Resume'). Google and other large software companies are notorious for asking puzzle questions. Jeff Atwood, founder of Stack Overflow, has repeatedly expressed a hate for these questions. I've bought one of Gayle's books. It was well- written and helpful. However, I assume most programmers starting with Codeschool, Lynda and others are just dipping their feet into the world of software not shooting for working at Google tomorrow.

Mastery of computer science concepts is important in the long term. But as a 'long-term' programmer (~2 years of serious programming), I have yet to implement my own complex data structures in production use beyond simple JSON objects. Libraries simply abstract most of these problems efficiently enough for most work.

I read a comment recently stating 'the best programmers don't need frameworks'. Of course! The best produce frameworks themselves! And more importantly, the best produce frameworks, languages, and tools to educate the next generation of programmers in best practices. (See zachgalant's comment above.)

For those of us in software, let us not challenge ourselves to achieve personal mastery and also to enable mastery and education for others.

</comment><comment><USER6> Everyone who has shipped a production site knows that codeschool doesn't have a mission to teach you "programming", so much as a stripper does not want to have sex with you. They are both meant to tease and entice you.

Given the author references a site like codeschool, I wish the author would have provided more direction/books/guides on how to become a programmer through knowing the conepts that he lists so that we could have a productive conversation over content rather than a service/business meant to address a giant market need (skilled workers in the CS field).

I can only speak to the merits of this article, it feels like it is just meant to get a rise out of the CS theory side and the non-CS theory side; which is sad.

<comment><USER7> I agree. I would have liked if the author had provided some ways to learn about these topics.

So then, what is the best website or video series to learn these topics? Wikipedia has a nice list of course, but I'm wondering if anyone here has found a particularly great resource they think their fellow HN members would find valuable?

I wonder somewhat humorously, if CodeSchool created a class to teach these topics, would the author's point be invalidated?

<comment><USER8> [http://ocw.mit.edu/courses/electrical-engineering-and- comput...](http://ocw.mit.edu/courses/electrical-engineering-and-computer- science/6-006-introduction-to-algorithms-fall-2011/lecture-videos/)

</comment></comment></comment><comment><USER9> The market for teaching Computer Science fundamentals is already rather crowded with thousands of Universities competing in that space. It's no surprise that Codeschool et al don't address that market. At their pricing level they are going for volume and volume is obviously at the lower end of the market.

Now there are to me two interesting points:

1\. Is there a market for a more advanced CS education delivered outside the University system? Coursera/Udacity/EdX cover this to some extent, but even here their courses are simplified versions of the University offering.

2\. Is there a way to do address the volume market in a significantly better way than Codeschool et all do? Their pedagogy is quite out-dated -- it's the old programming language as bag of syntax approach. The How to Design Programs (<http://htdp.org/>) approach, which I'm familiar with, is much better. I'm sure there are other initiatives.

<comment><USER10> Hello! I'm one of the co-founders of Dev Bootcamp (<http://devbootcamp.com>). The answer is 100% yes. :)

Funny enough, we go over basic data structures (linked lists, stacks, queues, etc.) in the first week at DBC and we emphasize at every level of the curriculum that being a good programmer means being able to translate some idea you have in your head into code. We teach mainly Ruby and JavaScript, but the students know it's incidental.

I just helped four students today finish their first-week project, which is a Sudoky solver. When they see the solver I wrote solve 500 puzzles in 5 seconds they want to know how. That's the perfect time to teach them about algorithms and data structures.

</comment></comment><comment><USER11> > Do you know what a binary tree is? The difference between a merge sort and a > quick sort? What the singleton pattern is, and why and when you should use > it? If you can't answer one or all of those questions, then it's time to > start learning the techniques.

A thousand times this, I'd respect a programmer who can do this and a lot more in a single language, rather than FizzBuzz on 10 different languages.

Even though being a polyglot helps (and provides different perspectives to solving problems - OO, functional, etc), a decent level of knowledge needs to be in place for that perspective to resort to anything of use.

<comment><USER6> Yes this would help for optimizing a giant site, but the author is referencing codeschool...that is like throwing a middle school football player into the NFL. Some things truly don't need that level of CS proficiency now-a-days.

</comment></comment><comment><USER12> There's always 2 sides to this argument. CS grads will say codeschool grads don't know enough CS fundamentals. On the other hand non-CS grads will say CS grads only know CS theory and don't actually know how to build products.

<comment><USER13> So, like many other problems, the solution lies somewhere between two extremes.

</comment></comment><comment><USER14> I would just like to point out that I believe the CodeSchool methodology is brilliant. I have tried fizzbuzzing my way through Codecademy, reading books and all sorts. But that is not the way I learn: I am an adult. I need to know context. I need goal oriented learning. Furthermore, I am an audio learner more than a visual learner, and because my memory is not as good as it used to be, I need more of the Kinesthetic.

CodeSchool isn't deep, but it gives me a solid overview of a topic and is good at what it does. I _wish_ there was a site out there that could teach me programming, not from fundamentals like a child, but from overarching context and concepts like an adult.

@zachgallant I will try out <http://codehs.com> next. Thanks for the rec!

</comment><comment> brian-frichette <http://tutsplus.com>

I have tried several subscription sites, and I prefer this one by far. A few things make it stand out for me: Variety of content and content depth allows you to get a taste for different languages, tools, and syntaxes, while learning enough to kindle the fires of interest. Kindling and nourishing exciting concepts and ideas is what allows for real learning to occur.

Second, I much prefer the more bare bones approach to teaching than the highly polished, high production, hand-holding that defines Code School. Generally, less time is spent on useless background information which noobs will never appreciate anyways and professionals don't generally give a crap about until they decide to "buy in".

Additionally, they tend to purposely leave in (or even intentionally create) errors while presenting that give important context to the underlying logic. This is the sort of thing that always either get cleaned up in post, or is not embraced for the teaching tool it is.

The only drawback is that it operates as a sort of freelance hub, and not all of the commissioned teachers are equally eloquent OR qualified. However, my feeling is that once you get to the point where you're learning advanced patterns, you're already looking at source code and participating in a community.

</comment><comment><USER15> This is dead on. Code School, Treehouse, etc. are all excellent learning resources. As are the in person bootcamps that teach you basic programming for roughly $10,000 and 3 months of your life.

But the one thing that traditional computer science education has over all of these sources is that they teach the really hard courses: algorithms, data structures, and discrete math.

The reason why Treehouse and the others don't teach this online is because it is incredibly difficult to teach these courses online. Udacity doesn't even do a great job (and they are the best in my opinion). What elevates the thinking of a programmer is a deep understanding of these topics. And, as far as I know and have experienced, the only way to gain this understanding is to struggle for months through problem sets, proofs, and dense textbooks. Gamified "programming for everyone" websites will give you tactics, but not strategy. This might be fine for your purposes, but please realize this: programming is not for everyone.

</comment><comment><USER16> You should really check out CodeHS -- <http://codehs.com>

It's focused on providing a strong fundamental background to absolute beginners, so they learn not just how to write a program but how to write a good program. We teach good programming style, variable and function naming, commenting your code.

Part of the curriculum is reading other peoples' code and critiquing it. Students learn to think like a programmer, not just follow instructions.

Right now, most of our content is a bit more basic than your recommended path to mastery, but it's all the steps to get you there. You can't underestimate the difficulty of understanding the difference between if and while for a beginner. Or the idea of parameters and return values, things that people with experience often take for granted.

also, feel free to email me if you want to learn more. email@example.com

<comment><USER17> I'm a bit biased, as I've worked with the guys behind CodeHS (tell Jeremy hi!), but I can vouch that it is one of, if not the the best, way to start learning to program.

The emphasis placed on control flow throughout the course has been extremely helpful to beginners. Also, the integration of proper programming style into lessons makes sure beginners write quality code, something I see missing from many courses.

I like to think of CodeHS as a gateway drug into programming. Once someone completes the first few series of lessons, taking on larger libraries is much easier.

</comment></comment><comment><USER18> This article completely misses the point of CodeSchool. CodeSchool's best selling point is exactly what the author is complaining about. I know how to program, I know how to design and analyse algorithms and I know my data structures inside out. I don't, however, know the best way to test Rails applications. CodeSchool provides a really accessible way for programmers to stay on top of the latest technologies, frameworks and idioms. It is not intended to replace a CS degree/education and I'm not entirely sure where the author even got that idea from.

<comment><USER19> I'm glad someone gets it. :)

</comment></comment><comment><USER20> I am a soon to graduate CS student, while I know a lot of theory about algorithms, data structures, parallel processing, numerical methods , architecture etc., sites like codecademy/treehouse/codeschool are great supplement. At university I learned basics of programming in java/C but only used them in some theoretical projects to learn about some algorithm/concept. Those sites are great to get into more practical aspect of computing and if you know basics of CS are a great way to pick up new language/framework/field.

</comment><comment><USER21> The key is balance between theory and craft.

</comment><comment><USER22> The article criticizes too soon. Here I explain this point, give some references where can get good explanations of the topics in the article, mention some more topics, and then explain what I believe is a more important guide to success in computing for the foreseeable future and, in particular, a low risk approach to very successful information technology startups. For this last, venture partners listen up.

Maybe the standard reference on design patterns is:

         o    Erich Gamma, Richard Helm, Ralph
              Johnson, John Vlissides, 'Design
              Patterns:  Elements of Reusable
              Object-Oriented Software', ISBN
              0-201-63361-2, Addison-Wesley,
              Reading, Massachusetts, 1995.

Most of the rest of what is mentioned in the article is in any of, say,

         o    Donald E. Knuth, 'The Art of Computer
              Programming, Volume 3, Sorting and
              Searching', ISBN 0-201-03803-X,
              Addison-Wesley, Reading,
              Massachusetts, 1969.

         o    Robert Sedgewick, Kevin Wayne,
              'Algorithms, 4th Edition', ISBN-10:
              032157351X, ISBN-13: 978-0321573513,
              Addison-Wesley, Reading,
              Massachusetts, 2011.

         o    Thomas H. Cormen, Charles E.
              Leiserson, Ronald L. Rivest, and
              Clifford Stein, 'Introduction to
              Algorithms, Second Edition', The MIT
              Press Cambridge.

              Also known as CLRS.

              Sometimes can find this on the
              Internet as a PDF. Amazon currently
              sells the third edition from 2009.

Two lectures of 90 minutes each are about enough to cover what the article has from the last three.

There's an ocean of more such stuff can stuff between ears.

E.g., once I needed something, worked it out, and later discovered I'd reinvented k-D trees. It's in Sedgewick. One project I was on made important use of extendible hashing as in

         Fagin, R.; Nievergelt, J.; Pippenger,
         N.; Strong, H. R. (September, 1979),
         "Extendible Hashing - A Fast Access
         Method for Dynamic Files", ACM
         Transactions on Database Systems 4
         (3):  315–344,
         doi:10.1145/320083.320092

or in

         Extendible hashing
         From Wikipedia, the free encyclopedia

at

         http://en.wikipedia.org/wiki/Extendible_hashing

In my current project, I needed to be able to read a list of, say, 10 million numbers and end up with the, say, 100 largest. To do that I borrowed the heap data structure from heap sort (in Knuth above).

Later I heard that a standard Google interview question asks much the same.

So, since I got some extra mileage out of the heap data structure in heap sort, I would criticize the article for asking for quick sort but not also heap sort: For sorting n items, heap sort is guaranteed to run in time proportional to (n)ln(n), but the corresponding expression for quick sort is n^2 (the guarantee including worst case) -- a bummer. Yes, usually in practice quick sort is significantly faster than heap sort.

There's too much of such stuff to carry it all around between one pair of ears. So, get an overview and use books such as above as references. Each of those algorithms takes only about an hour to understand and an hour to program. So, just wait until need such an algorithm.

Alas, CLRS tries to cover the simplex algorithm of linear programming, and my view that they botch the effort. Good coverage of linear programming takes more than an hour, but there are several good texts, e.g.,

         Vasek Chvatal, 'Linear Programming', ISBN
         0-7167-1587-2, W. H. Freeman, New York,
         1983.

But I believe that the article's author is missing a still bigger point: He is implicitly assuming that for writing a program, it is sufficient (1) to look at the real problem and (2) use knowledge of programming languages and algorithms to write the software. For problems we understand well enough how to do in principle essentially manually, sure. Otherwise, heavily not.

Here's an example (which we will generalize below): Write software to say how to feed update information to the control of the trajectory of a spacecraft touring the outer planets with, also, the ability to fly between Saturn and its inner most ring.

For this will also need to know (1) Newton's second law of motion, (2) Newton's law of gravity, and (3) how to setup and solve numerically with sufficient accuracy the resulting initial value problems for some nonlinear ordinary differential equations. So, need some physics, differential equations, and numerical analysis.

Note the 'pattern' that is going on here: (1) We start with the real problem, finding updates to the control of the trajectory of the spacecraft, (2) convert that real problem to a mathematical problem, (3) get a mathematical solution to the mathematical problem (e.g., with theorems and proofs from differential equations and numerical analysis), (4) program the mathematical solution.

So, we do not try to go directly from the real problem to a real solution and, instead, take a side detour from the real problem, into some mathematics, into some software, and then back to the real problem.

I claim that this 'pattern' will be of greatly increasing importance and value for computing starting now and for the foreseeable future. That is, we need ways to connect from the real problem to the real solution more powerful than just what we used to do manually or what we might do intuitively, with heuristics, genetic programming, 'machine learning', artificial intelligence, etc.

For an application of this pattern to information technology startups:

(1) Problem. Pick a "big ass" problem, one, say, 1+ Internet users in the US and around the world want solved. Pick a problem where for those users the first good or a much better solution will be a 'must have' instead of just a 'nice to have'.

The example from biomedical technology would be a safe, effective, cheap, patentable one pill cure for any cancer.

Note: Now with such a "big ass" problem we have a good shot at being able to f'get about subtle issues of UI/UX and 'product/market' fit. So, here we reduce 'market' risk.

(2) Do a faithful conversion of this problem into a precisely stated mathematical problem. The math involved might be original with advanced prerequisites. This conversion is usually from challenging to impossible. If cannot make this conversion, then return to (1) and pick another problem. Else continue.

(3) Solution. Find a mathematical solution to the mathematical problem. Want the solution to result, for the real problem, in the first good one or a much better one than anything else. The math involved might be original with advanced prerequisites. Finding this solution is usually from challenging to impossible. If cannot find such a solution, then return to (1) and pick another "big ass" problem. Else continue.

Note: A mathematical solution to a precisely stated mathematical problem is usually easy to check (follow theorems and proofs) with high reliability. So, if we have such a solution that checks, we have lowered project risk.

(4) Computing. Convert the mathematical solution to software to do the data manipulations. This work might be regarded as resulting in an 'algorithm' for the problem, but an 'algorithm' is just some code to do something, and without the mathematics such code has next to nothing to recommend it. So, we don't really want just an 'algorithm'; instead we want something logically solid from some mathematics.

The computing involved might be original with advanced prerequisites. This conversion is commonly from challenging to impossible. If cannot make this conversion, then return to (1) and pick another problem. Else continue.

(5) Deployment. Deploy the software, go live (say, on the Internet), get publicity, users, maybe ads, and revenue.

Note: Starting at step (1), this sequence has high risk. But given success through step (4), due to the big ass problem and the good or much better solution, step (5) has low risk.

So, if we can get through step (4), then we are GO for a valuable solution to a big ass problem, a solution 1+ billion people regard as a "must have" and not just a "nice to have", get to f'get about subtle issues of UI/UX and 'product/market fit' or a 'lean' development process with lots of feedback from the market and revisions of the work.

My view is that this sequence of (1)-(5) will grow rapidly in importance for computing and startups for the foreseeable future. In this case, the key is not some computing skills, classic algorithms, or computer science but some mathematics. possibly new with advanced prerequisites.

So, net my view is that for the future of computing the crucial academic material is from departments of mathematics instead of departments of computer science.

To be more clear, the advantage of the 'detour' into mathematics is get a solid, low risk 'logical chain' from the real problem to the computing and the real solution. That's part of what we want, right?

The only thing that surprises me about this sequence of (1)-(5) is that it has long been so standard in applications of applied mathematics, physical science, and engineering to the solution of important real problems but seems to be totally missing or nearly so from current venture funded information technology startups.</comment>


Apple EFI firmware passwords and the SCBO myth - <AUTHOR> https://reverse.put.as/2016/06/25/apple-efi-firmware-passwords-and-the-scbo-myth/ <comment><USER2> Apple is doing a much better job than all the rest of the PC vendors. Even those vendors that I haven't published keygens for [1] have just stupendously unsound bypass mechanisms for BIOS passwords.

[1] [https://dogber1.blogspot.com/2009/05/table-of-reverse- engine...](https://dogber1.blogspot.com/2009/05/table-of-reverse-engineered- bios.html)

<comment><USER3> Nevertheless, physical access still means it's game over; and I consider that a feature, not a bug. Given that, it's actually a little amusing that Apple went to all that effort for something that can be defeated with nothing more than a full BIOS reflash.

<comment><USER4> Maybe not so amusing! As far as I know, you'll need to take the machine apart to reflash it, plus special hardware — because when a firmware password is set, a Mac requires the password to choose a different boot disk.

with this feature, Apple HQ can give a service center the ability to clear a particular firmware password without giving them a universal backdoor (hardware _or_ software).

<comment><USER5> > As far as I know, you'll need to take the machine apart to reflash it, plus > special hardware

This doesn't take very long. Maybe 5 minutes to disassemble the machine.

As for hardware, you can flash SPI chips using a Teensy and a clip chip. [1] The total cost of parts is under $30.

Incidentally, I highly recommend investing in one of these if you're doing firmware development for routers. It's so much easier to flash a backup than muck around with TFTP.

> because when a firmware password is set, a Mac requires the password to > choose a different boot disk.

This is hardly unique to Apple. Most PC laptop manufacturers also disable changing the boot device or choosing a temporary boot device when a setup password is enabled.

> with this feature, Apple HQ can give a service center the ability to clear a > particular firmware password without giving them a universal backdoor > (hardware or software).

Um, this is how it works for PC firmware passwords as well. Unless there is a keygen available, most modern implementations use a hashed value from the serial number or hard drive as the master unlock password. It's unique to the laptop being unlocked.

[1] [https://trmm.net/SPI_flash](https://trmm.net/SPI_flash)

</comment></comment></comment></comment><comment><USER3> _These could be insiders working at Apple support centers or even Apple itself._

It makes me somewhat happy in a weird way to think that, even in notoriously locked-down and secretive companies like Apple, there are individuals who don't believe in and subvert the company's attempts to have sole control of its products. We have these individuals to thank for schematics, parts, and a lot of other material that feeds the third-party repair industry.

<comment><USER6> I'm not so sure the people selling SCBO files are the ones we'd consider the good guys. Or at least not based on their most likely buyers.

<comment><USER7> Correct, they're most likely allowing stolen computers to be used

Makes me wonder if their SCBO generating system is connected to their stolen serial number db (probably not)

<comment><USER3> _they 're most likely allowing stolen computers to be used_

Also those which have been recycled, or which someone has locked out accidentally, or deliberately _to scam someone_ ( [https://news.ycombinator.com/item?id=7993435](https://news.ycombinator.com/item?id=7993435) ), etc. Used computers from companies often have BIOS passwords that no one bothered to clear before sending them off. Not every computer with a password its current owner doesn't know is a stolen one. That's why I think this is a good thing --- I believe in the fact that if you physically own something, regardless of how you came to own it, you should truly "own" it.

<comment><USER7> Yes, I know there are legitimate cases of resetting the BIOS password

</comment></comment></comment></comment></comment><comment><USER8> This article is the kind that makes me sit down with a cup of coffee and read it top to bottom, even though I don't understand all of the low-level assembler details (but it's understandable without that). Security is important for everyone, not just security researchers.

</comment><comment><USER9> Can someone please cut me to the chase?

<comment><USER10> Apple can create a file to reset the flash password (it does not require tampering with the physical flash chip). This password reset file is RSA signed, so third parties can't create one from scratch unless they have stolen Apple's private key (unlikely), or have contacts inside Apple willing to make the file for them (more likely—all it takes is one unscrupulous employee with access to the reset file generation program).

</comment></comment><comment><USER11> What the hell does _SCBO_ even mean?

<comment><USER12> Dunno but Apple's EFI firmware files use the extension _SCAP_

</comment></comment><comment><USER13> Hmm... what about bugs in the USB / FireWire implementation of the EFI?

Or the good old FireWire DMA trick?

<comment><USER14> With the exception of the non-Retina MacBook Pro (which is due to be discontinued any day now), none of Apple's computers have FireWire anymore.

Even when they did, enabling a firmware password disabled FireWire DMA, even after boot. (And I'm not sure it was ever active during preboot.)

</comment></comment><comment><USER12> I wonder if we can expect this to change if Apple add a TouchID reader (and accompanying Secure Enclave) to the next generation of MacBooks

</comment><comment><USER15> TLDR? EFI password protection broken or not?

<comment><USER16> Apple has a backdoor for resetting firmware passwords via a special unlock file that must be cryptographically signed using Apple's private key(s).

In theory only Apple employees can sign the unlock files. How many employees have access to sign these unlock files? 10? 100? Every low-level employee? There may be some "bad apple" employees selling the signing of unlock files, some social engineering to trick Apple into providing signed files they shouldn't be, or a vulnerability the researcher has not found that allows attackers to bypass the public-key crypto implementation.

<comment><USER17> Since it's likely that every apple care center can perform this unlock there is a very good chance that there is a machine in virtually everyone of them that also has a service lab that makes these files.

The number of people that can unlock it is probably quite high, this isn't that different than removing an apple id from the device you need to go to the apple store with the device and proof of purchase and they do it for you.

<comment><USER4> Last I heard, service centers have to request these files from Apple on a case-by-case basis, so that only a small number of people need the ability to generate them. All of the complexity (writing a nonce to flash when the firmware password is changed, etc.) exists to make it easy for a service provider to apply an unlock _when authorized_.

I'd make a large bet that the same is true for removing Apple ID activation locks from devices.

<comment><USER16> Even if the employees capable of directly signing the files make up a very small group, they would probably be authorizing over the phone or a similar indirect route. This opens the door to social engineering by anyone, employee or not, who knows what number to dial and what information to provide. The tech would be authorizing the file without seeing the customer's device and proof of purchase themselves.

To foolproof the system, you would need less than a dozen people trusted with the ability to sign the files, and require the device and proof of purchase to be shipped to them rather than allowing unlocks to be authorized remotely.

It's unfortunate that the last line of defense against a stolen machine, the firmware password, has a backdoor. I'd have expected a firmware password on a MacBook to be just as difficult to bypass as an iPhone's passcode. Apple refuses to unlock phones, but will gladly remove a firmware password on a real machine. Disappointing.

<comment><USER4> The OS X equivalent of an iOS passcode is FileVault. Its current incarnation (v2) uses full disk encryption and doesn't have a (known) backdoor. (v1 used per-user encryption but didn't protect the rest of the disk, and v3 might use AFS to encrypt the whole disk in a way that users can only decrypt their own data and shared areas of the filesystem, not other users' data.)

Firmware passwords are more like Activation Lock for iOS. They make it harder to reuse a stolen computer and stop some less-invasive tampering, but don't offer any guarantees about protecting your data.</comment></comment></comment></comment></comment></comment>


Cuzillion - <AUTHOR> http://stevesouders.com/cuzillion/ <comment><USER2> After looking all over the home page, I had no idea what this does.

Then, after creating a page, I had no idea what just happened or why I should care about any of the information presented. Also, the page components still had the crosshairs mouse pointer style even though they were no longer draggable.

<comment><AUTHOR> Steve Souders is the man who was the head of Yahoo's Exceptional Performance Team, which gave us these rules for speeding up your website: <http://developer.yahoo.com/performance/> and also YSlow.

Cuzillion is something he seems to have made to give you a generalized example of what components affect your performance and by how much. So it allows you to test a fabricated example rather than a specific website.</comment></comment>


Official Google Blog: Helping healthcare providers become more efficient - <AUTHOR> http://googleblog.blogspot.com/2008/12/helping-healthcare-providers-become.html <comment><USER2> How is Goog making money from this?</comment>


Shareaholic has been successfully installed. - <AUTHOR> http://www.shareaholic.com/tools/firefox/welcome/184.108.40.206 <comment><USER2> cool</comment>


PHP 7.4 beta 1 is released - <AUTHOR> https://externals.io/message/106249 <comment><AUTHOR> A complete list of new features, changes and deprecations can be found here: [https://stitcher.io/blog/new-in-php-74](https://stitcher.io/blog/new-in- php-74)</comment>


Body weight homeostat that regulates fat mass independently of leptin in mice - <AUTHOR> http://www.pnas.org/content/115/2/427.long <comment><USER2> How big were these implant capsules? The rodents might have been cronically uncomfortable and that may have been a factor in their loss of appetite. I know when I feel sick I don't eat as much. Could they do this again with a larger animal with weights that could be applied without any potential discomfort? Or would putting huge weights on your knees while sitting make you less likely to binge eat?

<comment><AUTHOR> The size of the implant can't be the issue because the implants (empty) were also implanted in the active controls, who maintained their weight/food intake. Any discomfort must have come from the additional weight, but of course, that ought to also be true of mice who are fat. The crosscheck with the less-boney mice, without any implants at all, also helps support that it is the change in weight itself and not an associated effect of the implanted spheres, which is the cause.

> Could they do this again with a larger animal with weights that could be > applied without any potential discomfort?

One hopes so. Larger animals are harder to work with, of course. But it's wild to imagine that putting on a weight vest might help you lose weight, even for a field which has no shortage of strange results relating to genetics/diet/metabolism/weightloss once you go beyond theological doctrine like CICO.

<comment><USER2> Thanks for that. On the flip of this concept do astronauts have more difficulty with appetite in space than they do on earth due to the feeling of weightlessness?

<comment><AUTHOR> I believe they have trouble with everything, but it's so general that you can't attribute it to a single cause like 'the osteocyst weight homeostat goes haywire' (for example, how would that cause the eye problems?).</comment></comment></comment></comment>


Running a startup – perception and reality - <AUTHOR> https://medium.com/@sensinum/running-a-startup-perception-and-reality-1c9028fcb46f <comment><AUTHOR> Most likely, every IT specialist has dreamed of running his or her own company at some point in their life. Is this really a great opportunity? What's it actually like? Some myths and answers inside!</comment>


Iran Unveils Its First-Ever Domestically-Built Fighter Jet - <AUTHOR> http://en.businesstimes.cn/articles/102131/20180822/iran-unveils-first-domestically-built-fighter-jet.htm <comment><USER2> It looks suspiciously like an F-5, doesn't it?

<comment><USER3> that or the mirage

<comment><USER2> No. I know these fighters from the Brazilian air force. It's an F-5. They probably are able to manufacture parts for them, but it's most certainly not an original design.

There is a good incentive to make parts for them and to, eventually, be able to build the complete plane themselves because they have quite a few F-5's and they are reasonably effective against their regional rivals. If they managed to get reasonably modern avionics and weapons in these, they could defend Iranian territory quite well. A lot of military pilots trained on its brother, the T-38.

Lower speed and worse maneuverability make no difference if they can lock a missile on you before you can do the same to them.</comment></comment></comment>


Apple Watch to Be Sold at Best Buy - <AUTHOR> http://blogs.wsj.com/digits/2015/07/26/draft-apple-watch-to-start-selling-at-best-buy/?mod=ST1 <comment><USER2> At the BB near me, there's basically a mini Apple Store set up in house. This move makes sense.

<comment><USER3> This is the major signal I've been waiting for ... Apple is losing its cachet. Calvin Klein jeans used to be a fashion item, but when Costco started carrying them, favor had been lost. (No knock on Costco, buck-fifty hot dog and drink can't be beat.)

<comment><USER4> Cachet, seriously? Apple has been producing for the masses for many years, quite successfully actually. If you think they haven't their marketing has worked brilliantly on you.

<comment><USER5> _Cachet: 1. the state of being respected or admired; prestige. 2. a distinguishing mark or seal._

Are you balking at the use of the word or at the idea that Apple is losing it (or do you think they never had it)?

They've certainly got cachet thanks to brilliant marketing, but it's inevitable that they will lose it at some point since they're on top right now and they've got nowhere to go but down.

</comment></comment></comment></comment><comment><USER6> More accurately, it will be offered for sale at Best Buy. It is to be determined if people will buy it there. Pebble is there, Android wear is there, apple watch will be just another watch there for sale.

<comment><USER7> > Android wear is there

Android Wear does not compete with the Apple Watch; which one you can buy is wholly determined by the smartphone you already own. Pebble is the only thing that competes with both.</comment></comment>


US conservatives accuse Facebook of censorship - <AUTHOR> http://mobile.nytimes.com/2016/05/10/technology/conservatives-accuse-facebook-of-political-bias.html <comment><USER2> I think that US conservatives have a long history of whining about stuff like this.

In the 70s and 80s, the press had a liberal bias, and wouldn't write anything conservative.

In the 90s and early 2000s, colleges and universities didn't hire or promote conservative professors.

The IRS was singling out conservative groups to examine for tax exempt status.

I'm sensing a pattern.

<comment><USER3> As it turns out, you just described Limbaugh's opening monologue of the last 10 min.

</comment></comment><comment><USER4> Extensive discussion of the original source, the article on gizmodo.com:

[https://news.ycombinator.com/item?id=11659565](https://news.ycombinator.com/item?id=11659565)</comment>


Google Program to Deradicalize Jihadis Will Be Used for American Extremists Next - <AUTHOR> https://theintercept.com/2016/09/07/google-program-to-deradicalize-jihadis-will-be-used-for-right-wing-american-extremists-next/ <comment><USER2> On the Media had a podcast that talked about this: [http://www.wnyc.org/story/challenge-fighting-terrorism- onlin...](http://www.wnyc.org/story/challenge-fighting-terrorism-online)

Essentially experts agree that this will do next to nothing to stop individuals from radicalizing.

However, I bet that this program will prove to be a useful propaganda tool to be used on everyone else though.

</comment><comment><USER3> I strongly disagree with this.

Private companies probably should not have political agendas.

Why don't they use this program against anarchists and Occupy Wall Street extremists? They're focusing specifically on hard right extremists.

<comment><USER4> When you're the size of Google, it's not a question of you being interested in politics: politics is interested in you.

<comment><USER3> What happens then is you kick back.

Their motto is "Do no Evil". This is an active act of suppressing views that don't fit their cultural narrative.

</comment></comment></comment><comment><AUTHOR> Apologies for the mangled title here. The original is much too long to fit in the HN limit, and removing "American" instead of "Right-Wing" isn't enough to solve that. The fact that Google and by extension its resources is involved seems like important context, so I'm not inclined to remove that part. If someone has a better solution I invite changing it.

<comment><USER5> The "next" is redundant, and there are shorter words than "extremists". "will be used for American extremists next" can get shortened slightly to "will be used on the American hard-right". If it fits, you can add back in the "next" on the end.

</comment></comment><comment><USER6> wildly disagree with this program; it will be used to propagandize the american public further, if it hasn't already.

remember that hillary and google are tight. remember that they don't work for you.

<comment><USER2> It's kind of interesting to think about the public concern that'd be generated if this article was instead about the government and the New York Times buddying up to use the Time's bestseller book list to deradicalize people. People today can easily grasp the dangers of book censorship and propaganda, so it's alarming and interesting that social media gets such a pass.

p.s. I'm not saying that the NYT's bestseller list is free of manipulation, I'm saying they don't openly acknowledge such manipulations to the public.</comment></comment>


Top Anki add-ons used by med students - <AUTHOR> https://getpolarized.io/2020/02/14/Must-have-Anki-Add-ons-for-Medical-Students-in-2020.html <comment><USER2> Pokemanki looks awesome!

The idea of Polar is also intriguing. I found a visual bug on your page:

[https://i.imgur.com/P8dHkI9.png](https://i.imgur.com/P8dHkI9.png)</comment>