Day One with the Amazon API Gateway - <AUTHOR> https://blog.hiramsoftware.com/blog/day-one-aws-api-gateway/index.html <comment><USER2> Thanks for a clear, sensible investigation. ISTM your auth complaint is well- taken. Either Lambda should be seeing the same role as the gateway automatically, or there ought to be a way to configure that.

However, I have to admit that my first reaction to that difficulty in getting the account ID from the path/query/etc would have been to just shove it in the request body JSON that was already coming through. Then it could probably be taken out of the path completely, which would be a win for url privacy at least. This doesn't seem like the showstopper that the auth issue does.

</comment><comment><USER3> Amen.

Last Sunday morning, I was so excited to move my APIs over to AWS's API Gateway. That evening, I was ready to kill.

I spent the entire day (9+ hrs) getting merely two API routes working. A GET and a dreaded POST request.

I couldn't tell from your post if you eventually figured it out, but it is possible to get the POST request body and url params in your Lambda event as JSON.

In my POST Method's Integration Request, here's how I get the query string parameter and the request body. I use this Input Mapping.

#set($inputRoot = $input.path('$')) { "access_token":"$input.params('access_token')", "name" : "$inputRoot.name", "email" : "$inputRoot.email" }

A "glass half full" way to think about all of this is that the AWS API Gateway is ridiculously strict about what data can be passed in to your Lambda functions, and you must explicitly state that data.

Here are other problems I ran into over the weekend:

\- The web console is super buggy with broken links and really, really bad UX.

\- The documentation is missing for many essential components.

\- No support for API Gateway in the AWS SDKs

\- I can't figure out how to copy resource methods, so I have to do tons of redundant manual input when creating each resource method, which includes explicitly stating every HTTP Error response code.

\- Returning error objects from Lambda functions also needs mapping.

\- Out-of-the-box slow response times. My Lambda function with two simple DynamoDB queries often takes 3 seconds to return a result when its route is hit.

Overall, I'm a huge AWS fanboy but the execution of this product is incomplete and out of touch.

C'mon AWS, you can pull through on this. Keep it simple. Build out from there. We all want you to succeed.

<comment><USER3> UPDATE: They just announced a nice fix for easily getting the request JSON Body into your Lambda functions and some documentation improvements. See jeffbar's post in this thread.

</comment></comment><comment><USER4> Good write-up, interesting find about the lacking features. My take on the API Gateway - [https://email@example.com/moving-a-simple-api-to- amazon...](https://email@example.com/moving-a-simple-api-to-amazon-s-api- gateway-680d025e0921)

</comment><comment><USER5> I spent some time reviewing this post with the API Gateway team here at Amazon! Here's what I learned:

1\. We are updating the documentation in response to the feedback in this thread and in the blog post. Additional feedback is always welcome.

2\. Based on the feedback in the blog post, mappings can now access the JSON body of a POST. See the answer (login required) at [https://forums.aws.amazon.com/thread.jspa?messageID=645596&#...](https://forums.aws.amazon.com/thread.jspa?messageID=645596&#645596) .

3\. Models are not required for validation. They are simply used to generate the objects in the client SDKs.

<comment><USER6> Hi Jeff, thanks for responding to the feedback. Personally I'm just concerned about two things:

\- Execution response time: the responses to API > Lambda > DynamoDB are too slow

\- Reference Samples: we need docs and/or code samples with the most common patterns and workflows for mBaaS and IoT (i.e: user authentication with JWT and ACLs via the API > Lambda > Dynamo)

Many of us are stoked about this product. Hope you can iron out the issues that the community is raising and that are preventing wider adoption. The concept of server-less microservices via REST looks like the next big trend after containers. Hope you get it just right soon... I plan to make intensive use of this service in no time! =)

Cheers

<comment><USER3> Out of curiosity, are you getting slow response times only on the first request, or on all?

I'm also using API Gateway + Lambda + DynamoDB

All of them are very slow on first request, even the DynamoDB queries. After that, they're much quicker, unless there are maybe 5 mins of inactivity.

<comment><USER6> Specially the first, then it seems like it improves, but still a bit laggy compared to some of the APIs I've built with Django or Node/Loopback...

</comment></comment></comment></comment><comment><USER7> I spend some time with API Gateway this weekend. Since I work at a company that has a product that helps customers with authentication and authorization for APIs, I am always curious where everyone else is skating.

Your section about authentication resounds with me loud and clear, I couldn't hack it out in 6 hours. This will be a pain point for anyone using API Gateway for anything other than a toy API.

</comment><comment><USER8> Having the possibility to create an HTTP RESTful interface to many Lambda functions running on AWS is the biggest advantage of the AWS API Gateway.

Technically, stretching the system a bit, one could argue that we don't need backend software running on EC2 anymore, since everything can be a Lambda function with an associated HTTP endpoint to trigger it. I have been thinking about this a lot, and it _could_ work if being locked into AWS is considered an acceptable risk.

For anything else more API-oriented (more authentication schemes, better security, more logging options, etc) I would suggest checking out Kong ([https://github.com/Mashape/kong](https://github.com/Mashape/kong)), which is pluggable with extra functionality and can work in front of the AWS API Gateway to enhance the REST-to-Lambda interface (and with any other API).

<comment><USER9> > I have been thinking about this a lot, and it could work if being locked > into AWS is considered an acceptable risk.

This is a huge risk. If they shut you out, for whatever reason, you're done. You can't port your code to somewhere else. It's Lambda specific.

<comment><USER10> >You can't port your code to somewhere else. It's Lambda specific.

is that really true tho? Its just a function that does work from a request and send the result off to some where else.

<comment><USER8> You won't be able to port it _without_ any additional work, but if you are willing to do some refactoring (specifically removing the Lambda-specific objects, etc) then it can run anywhere. Of course the time this will take depends on the size of the project, but it can be definitely done without rewriting the whole application, but just rewriting the "invoker" part.

To make a future port easier, the functions could also be modularized by keeping the real business logic and the Lambda integration separate, but integrated.

<comment><USER10> how many Lambda-specific objects are there besides the context promise?

</comment></comment></comment></comment></comment><comment><USER11> My take after trying this out for a few hours mirrors yours: it looks like it was rushed out the door and not 100% ready. It's fun to play around with, but I wouldn't put anything production on it for at least another few months.

<comment><USER12> I agree - the docs are kinda hard to parse, and after launch it didn't work in us-west-2 for several hours. I've got great ideas for what I can build with it if they fix a few issues with it, but for now it's just a toy.

</comment></comment><comment><USER13> The other thing that is terrible is versioning. Lambda does not support versioning. And the resources/methods that you define for your various stages all share the same resources/methods, unless you want to change the signature of your calls. So if I want to change an existing Lambda function, then the minute I change it for my staging/test/qa environment, I have changed it for production as well. So, I can't roll back easily. I can script all this, but ouch. The alternative is to create a whole new API gateway, but that means that once I get my stuff tested, I essentially have to recreate my new environment in production, insteading of just clicking a button.

We have a client who is looking at sending a massive amount of data to a REST API. Looks like we are going back to Elastic Beanstalk, which is pretty good, it just has servers. But it works.

And, I'd say that using Dyanamo as a DB locks you much more securely into AWS than API Gateway and Lambda. Be pretty easy to take those Lambda functions and map them back into Express or Restify routes. Changing the database, arg.

</comment><comment><USER14> I've started messing with API Gateway and Lambda there a couple errors.

If you create a lambda function and add a gateway inside the lambda function configuration screen, it will give you a bad API gateway URL. Going into the API gateway page and looking at your stages URL and trying that works.

This just proves that it was rushed out. I do like the idea though and want to use it, but I don't think it'll be ready until Q4.

</comment><comment><USER6> > Out-of-the-box slow response times. My Lambda function with two simple > DynamoDB queries often takes 3 seconds to return a result when its route is > hit.

This is something I've also noticed. Even their official examples are really slow [0]

About auth: I've been researching API Gateway + Lambda and auth via Amazon Cognito. As of now the best example for auth I've found is LambdAuth [1]. I'm trying to add the API Gateway in the mix, it looks possible to integrate it.

I also agree that docs and more explicit examples are needed.

[0] [https://aws.amazon.com/blogs/compute/the-squirrelbin- archite...](https://aws.amazon.com/blogs/compute/the-squirrelbin-architecture- a-serverless-microservice-using-aws-lambda/)

[1] [https://github.com/danilop/LambdAuth](https://github.com/danilop/LambdAuth)

<comment><USER15> Apparently, there's no way to use API Gateway with Cognito, it looks (and should be possible) there are so many lacks in the documentation... I'm following this forum thread [0] regarding Cognito integration in JS. [0] [https://forums.aws.amazon.com/message.jspa?messageID=645618#...](https://forums.aws.amazon.com/message.jspa?messageID=645618#645618)

</comment></comment><comment><USER16> Just a quick nitpick: the second link in the article (the one to AWS Lambda) should have an all-lowercase URL; the URL's case-sensitive and - in its current capitalized form - is resulting in a 404.

</comment><comment><USER17> I'd come across the same issues you are experiencing and had been looking for a solution to the $input.path() issue.

Turns out to retrieve JSON you can use $input.json().

Full details are on the AWS documentation page. Not sure if this has been newly added as I only found it today.

[http://docs.aws.amazon.com/apigateway/latest/developerguide/...](http://docs.aws.amazon.com/apigateway/latest/developerguide/api- gateway-mapping-template-reference.html)

</comment><comment><USER18> The feature-set for this is pretty low. I've built a better solution with much more raw access to HTTP request and response streams.

If anyone is interested in an open-source version of Amazon API / Amazon Lamba, you can check out: [http://github.com/bigcompany/hook.io](http://github.com/bigcompany/hook.io) [http://hook.io](http://hook.io)

</comment><comment><USER12> I've experienced the same frustrations with the API Gateway. Lack of knowing the IAM principal that authenticated, and no clear way to differentiate if a call came from the API gateway or not makes me feel that this needs some work. SNS, for example, will sign it's HTTP requests and that would be a good start IMHO. Ability to use security groups in proxy mode would make this even better.

</comment><comment><USER19> My major use case is a read only, throttled, and cached front end for the mediawiki api at [http://snpedia.com](http://snpedia.com) . The ability to monetize the api for higher throughput is an appealing plus. Gateway still seems pretty good for this. I'd welcome input or thoughts from others.

</comment><comment><USER20> thanks for your sacrifice in investigating this. I will return in 2016 when hopefully this is production-ready

</comment><comment><USER21> Isn't lambda suicide for a startup? Think of all the lock-in here. If you go big you could suddenly find yourself really stuck if you're overly dependent on it and the overhead of lambda/gateway is too much.

<comment><USER22> It's actually not bad at all - I can't speak for the java side of things, but transitioning a couple random nodejs services to lambda took under ten minutes each, with most of that time being testing (my only complaint is that the logging sucks). Lambda function are so modular that I can't imagine not being able to trivially slot them back in to a standard express endpoint. It might be tricky if you do a bunch of stuff with S3, but even then it shouldn't be terribly difficult to sub in the standard AWS modules.</comment></comment>


Ask HN: starting iOS dev: best Mac value? - <AUTHOR>

We've been accepted into MFi and will need to code up a few simple iOS apps.  We're a windows shop, so that means buying a new Mac or two.  I have no idea which model provides the the best bang for the buck--any advice?  I doubt that we'll use it for much more than compiling and loading apps onto devices. <comment><USER2> I am not sure where you live, or if you are comfortable with buying things off of Craigslist...

1) You should be able to find a perfectly capable used iMac or macbook (pro) on Craigslist for anywhere between $400 - $800.

2) If Craigslist is not your thing, Apple has an excellent refurbished program, I have bought refurb. a number of times with no problems.

[http://store.apple.com/us/browse/home/specialdeals/mac?mco=O...](http://store.apple.com/us/browse/home/specialdeals/mac?mco=OTY2ODY3Nw)

3) If you want to go brand new, any of the MacBook Air's or iMac desktops would be perfect.

<comment><AUTHOR> We're in rural southern US. Not a lot of Macs on the local CL. Boss man is more comfortable with new, or at least factory refurb.

</comment></comment><comment><USER3> I'd say a MacBook Air (portable) or iMac (desktop) absent any other information, but I'd also recommend checking out this article:

<http://brooksreview.net/2011/05/macs-cars/>

What is MFi?

<comment><USER4> MFi: <http://developer.apple.com/programs/mfi/> Hardware for iPhone, iPod, iPad platforms.

</comment></comment><comment><USER5> Macbook Air. I'm an MS guy, it can actually handle having a Win7 VM w/ Visual Studio alongside Xcode (not brilliantly, but adequately).

That way you can use it as your laptop too, and it's a frigging nice little laptop.

</comment><comment><USER6> Consider the mini, though it is overdue for a hardware update. A mini with a Sandy Bridge processor, Thunderbolt connector, and SSD would actually be a pretty sweet little workstation.

The bang-for-the-buck factor on the SSD is in your compile times.</comment>


Doctor Performs First Google Glass Equipped Surgery - <AUTHOR> http://www.pcmag.com/article2/0,2817,2420852,00.asp

<comment><USER2> If I read the article correctly, all he did was use Glass as a live-stream POV camera. How is this different than the pre-Glass era?

I think what would be significant is if Glass were able to enhance his ability as a surgeon during the procedure, rather than just allowing remote viewing.

<comment><USER3> A lot. He doesn't need another assitant for the camera. Also he might be able to communicate with another doctor while in operation and have better control of the video.

<comment><USER2> Wearing Glass is no different that wearing a POV camera. Communication still falls into the realm of everything that was possible pre-Glass.

Now if the patient swallowed some nanobots that found their way to source of the problem and then Glass guided the doctor to that location via a Google Navigation-like interface, that would be impressive.

</comment></comment></comment><comment><USER4> That's impressive. Being a bit skeptical about Glass as a casually wearable device, I just realized how many there are specialized use cases in which a small video transmitter on one's forehead can be indispensable.

It could be a person learning to parachute jump, or defusing a bomb—cases where one has to deal with uncertainty in critical situation.

(There are a lot of evil ways to use this, but that could be said about any useful technology, I think.)

I only wish Glass was more of a general purpose platform and worry that there seem to be no competition.

<comment><USER5> EyeTap is a more general wearable solution and has been around for long time. Google Steve Mann / EyeTap or Read Mann's "Intelligent Image Processing" for more info.

<comment><USER4> Interesting, thanks! But yes, it's apparently much more general (you have to implement everything apart from recording and displaying video, which EyeTap seems to be only about) and more intrusive than Glass.

<comment><USER5> I have seen a couple of pictures of Eyetap prototypes that look just like regular bi-focal lenses. But you're right, one has to do more work to implement the kind of stuff one would take for granted on Glass - I guess one would have to think of EyeTap as a more personalised "home-brew" Glass.</comment></comment></comment></comment>


IllumiPaper: Illuminated Interactive Paper - <AUTHOR> https://imld.de/en/research/research-projects/illumipaper/ <comment><USER2> SCNR, but this is the most German thing I've found on hacker news for a long time.

I can hardly come up with a use case, for which this would be a better fit than just a tablet.

Disclaimer: I'm German ;)

</comment><comment><USER3> Demo video: [https://www.youtube.com/watch?v=u5ZmPzI0D2Q](https://www.youtube.com/watch?v=u5ZmPzI0D2Q)

<comment><USER4> Is that really a computer generated voice-over ? And if so, why ?!

<comment><USER5> Doing voice overs takes a bit of talent and a lot of practice. Using a CG voice over is cheap low effort even if low quality.

<comment><USER6> Also, authors may not be native English speakers, which makes it even harder

<comment><USER5> There is that. Self confidence also plays a huge role. Some people can't standard hearing their own voice and can't find anyone else willing to do it (or are too shy to ask). You'll find a lot of these people inn CS research who think CG voice is an easy way out of that anxiety.

</comment></comment></comment></comment></comment><comment><USER7> In 2001 Wired had an article about a company making a pen that could read microdots on paper while you are writing. It would then be able to uniquely identify the paper that you wrote on and correlate what you wrote with, for example, the form you wrote it on.

I'd wondered a few times what happened to that company (Anoto), thinking they are probably long gone. Turns out they are around, and the pen they are using in this article is actually one of their models. Not sure if it is still using the microdot idea though.

[1] [https://www.wired.com/2001/04/anoto/](https://www.wired.com/2001/04/anoto/)

<comment><USER8> > _In 2001 Wired had an article about a company making a pen that could read > microdots on paper while you are writing. It would then be able to uniquely > identify the paper that you wrote on and correlate what you wrote with, for > example, the form you wrote it on._

/me know that some laser printers use same type of _steganography_

</comment></comment><comment><USER9> How or why is this better than an iPad with the Apple Pencil? It had better be wayyyy less expensive or better in every aspect otherwise it is dead in the water, imo.

<comment><USER10> Looks like publication of research, not a product.

</comment></comment><comment><USER11> First thought I had when I saw the paper: it could be used to enhance board games.

</comment><comment><USER12> Solution looking for a problem ...</comment>


Show HN: Self-Funded Tech Companies - <AUTHOR> https://github.com/joshwais/Self-Funded-Tech-Companies/ <comment><USER2> Fyi, Campaign Monitor went to the dark side:

[http://www.afr.com/technology/250m-funding-enough-for- campai...](http://www.afr.com/technology/250m-funding-enough-for-campaign- monitor-as-it-looks-to-keep-control-of-its-destiny-20170125-gtygra)

</comment><comment><USER3> This is pretty cool and encouraging.

I do think if your after hypergrowth you need some money though.

<comment><AUTHOR> I agree. I think you have to be conscious about what the opportunity necessitates and what you personally are looking for.

</comment></comment><comment><USER4> GitHub is on the list, but took vc money in 2012</comment>


We're #3 on Paul Graham's Frighteningly Ambitious Idea List - <AUTHOR> http://turingcollege.blogspot.com/2012/03/were-3-on-paul-grahams-frighteningly.html <comment><USER2> That's an excitingly ambitious project. I really hope you guys pull it off.

One (extended) question though:

The first course is "a cutting-edge class in web application development for mobile devices. Not only does it use texts focused on practical application and cover tech like PhoneGap, Jo, Sencha, jQTouch, and jQuery Mobile, but it is taught by a real-world developer with decades of university teaching experience".

That's not a university course, that's a trade school course. Look at the "textbooks". Probably a useful one but it's not CS. I know you say "We not only teach CS/SE theory at the highest level, but also provide the practical implementation that prepares you to excel in the workplace." but to be honest that seems like a lie. I don't have much experience with teaching CS but I have some.

The idea that you could teach a practical (necessarily complex) toolkit at the same time or alongside high level CS concepts seems absurd. Students have a hard enough time getting those high level concepts to click but now they are mixing trade school toolkit training in at the same time? Those two goals conflict with each other. It's like using gcc internals for a compiler course.

I am so onboard with the online, just in time, at your own pace learning thing. But I have to say that the copy on this page has seriously dampened by enthusiam.

You're called "Turing College" and the only course is a trade school mobile app course covering mobile app framework libraries (at least they'll have to come back in 6 months for the new version of the course) and say things like this: "We're teaching you to be a rock star, not just look like one on paper". WTF? Was brogrammercollege.blogspot.com taken? And blogspot? really?

I hope my impression is wrong, but I'm not coming away with a good one from this page.

<comment><AUTHOR> Thanks for the feedback on the copy. It's always hard to find that balance between being informal and jokingly reference overused terms like "rockstar", and being unnecessarily stuffy. We'll definitely take your comments to heart though as we refine the general descriptions.

The whole concept of being able to mix real world (trade school) courses with heavy theory is a tricky question. We have traditional theory heavy courses in the pipeline, but realistically, it is extremely difficult to bootstrap with theoretical courses. It's been tried before and typically fails quickly. Oddly enough, you can give away theoretical classes, and you can charge $10,000 a class for them, but you can't really sell enough at our $200-$400 price point to pay for the cost of developing the class. We believe you can teach both, and should teach both, but I'm well aware that we'll always have people saying you can't or shouldn't even attempt to do so.

Oh, one note on the textbooks for the course. Of course there is an image issue when you use Oreilly and Apress texts, but honestly, for that subject there just aren't any traditional texts that come anywhere near the level needed to teach the subject. Even those three have serious holes that Dr. Ostrowski has worked with the authors to plug in this course. If you know of a better text that we somehow overlooked, please drop me a note and we'll see if we can integrate it as we create V2 of the course.

<comment><USER3> Perhaps your use of the word "college" is currently misleading. As the OP says, you're really offering trade school classes. When you offer a comprehensive curriculum that includes a theoretical underpinning, that's when you're a "college".

<comment><AUTHOR> Our first class definitely has practical application, but it is still taught by a PHD and covers more ground at a higher level than the current college or university standard.

If teaching applied material makes you a trade school, someone should tell Harvard: <http://cs76.tv/2012/spring/>

As for the use of the word "college", well, it's the most accurate descriptor of what we are building. We're not there yet, but we will be soon, and having to print a whole new batch of business cards is just too darn expensive. We could have chosen a more startup-ey name, but we hate startup-ey names. I could have named it after myself as well, maybe something like "Huffman Coding". We checked though, and that was taken.

While we're discussing it though, singularity university isn't a university, and clown college does not cover the theoretical aspect of clowning sufficiently. Also, University of Maryland College University is mildly redundant. And why do you park on the drive way and drive on the park way?

<comment><USER2> Since I started using the term "trade school" here I want to be clear I don't use it as a pejorative term, just a differentiation.

</comment></comment></comment></comment></comment><comment><USER4> I believe most of the new-model online/for-profit universities actually had to buy older universities to get their accreditation.

So I doubt that "play[ing] their game better than they do" by pursuing traditional accreditation is really the disruptive strategy here. Blow up the whole rotten credentialist system and replace it with something very different.

(A meta-credentialing service might be a neat startup. With an explosion of non-traditional courses, certifications, and credentials, which actually hold up as meaning something? Communicating something here is a process, trust, and even data/statistics challenge – a nice community/tech opportunity.)

<comment><USER5> I agree - very hard to start a (long-course) educational institution without first establishing the credibility (in the actual industry, not to the govt.) of the certificate you get at the end of it.

What a system like this really needs is a strong way for future employers of graduates to rate their relative ability (eg. 'according to our benchmarks this person's ability in python lies _x_ far between the average coder on github and [insert famous python user here]').

Perhaps establishing 'credentialing' should come before establishing a school?

<comment><AUTHOR> You would think so, but we actually can't even apply for regional accreditation until the first student graduates from a full degree program.

Yes, the system is rigged against new entrants.

</comment></comment></comment><comment><USER6> _Just-in-time learning is the future. No ifs, ands, or buts. Any argument you might have to the contrary is not only wrong, but dangerously wrong ... The current system of teaching students everything they might need to know, just in case it ever comes up, is an artificial construct that resulted from limited access to books and a limited amount of time available for study. Just in time, on the other hand, is how we actually learn by default._

This is an interesting point. I happen to disagree, and I hoped that the author would go on to say exactly why it's wrong, especially dangerously so. It seems like the author rejects curriculum-based courses of study that provide a broad, solid foundation in favor of just-in-time courses of study, in which one learns whatever is necessary at the moment, right before applying it.

My main objections are that

* There are things you don't feel like learning that you would do well to learn. I had a lot of freedom to choose courses during school, which was great, but I am about to graduate with a lot of holes in my knowledge.

* No matter how smart you are, you would benefit from the guidance of a teacher --- guidance _through a full curriculum_ that gives you a solid foundation and imparts onto you important patterns of thought.

<comment><AUTHOR> I was hoping this comment would come up, actually. The real difference in just in time vs. just in case has to do with delivery, sequencing and retention. A broad, solid foundation sounds great on paper, but there are some hard realities that sink in shortly after graduating. First, within about 6 months the amount of actual knowledge you retain from this foundation is probably going to be between 5 and 7%. That's 5-7% of the total from a not very efficient 4 or 5 years of dedicated study. How not efficient? Well, if you look at the in major portion of your degree, you probably had about 450 hours in real classroom instruction, or a little under 2 hours a week. So, of those 450 hours, you will probably retain less than 30 or 40 hours worth of real useful knowledge. you may dismiss this as hyperbole, but trust me, all that work dissolves incredibly quickly. I remember Big O, a couple of formulas, and the ability to order a sandwich (or was it a donut) in German.

More importantly, though, is the fact that since you only have 40 or so classroom hours in any class, and you have to teach to the average, it is extremely difficult to build up to a properly high level of skill in any particular subject. It _feels_ hard while you are doing it, but after you graduate, you realize the people who have been focusing on the subject for a couple years are light years ahead of you. It's even more difficult to chain subject together to reach that high level. The closest thing we have is a generic 100,200,300 level system with some prerequisites.

How does this relate to just in time vs just in case? Even if you assume an identical breadth of knowledge, being able to sequence classes together in series instead of having semester and scheduling gaps means you go into the next class with more knowledge retained from the previous, which means you can build on your foundation in a more logical and efficient way and reach those higher levels that you just can't in a fragmented system. You can approach this from the ground up (building on higher and higher concepts), but the very nature of a JIT system means you can also approach it from the top down. That is, you can define the ends result or top level class, and then sequence each course to build up the fundamentals you need, just before you need them.

The point? If you are defining a broad base of skills, JIT allows you to master each one quicker and sequence them together to reach higher levels of mastery. If you need skills in the real world, JIT is the quickest and most efficient way to build those skills. The reason I consider disagreeing to be dangerously wrong, is that JIT is so much more effective at real education that those who bank on JIC for their future (students, schools, or countries) will find themselves left in the dustbin of history.

<comment><USER6> Thanks for the thorough reply. It seems we agree on a few key points:

1) Retention sucks in the current model of higher education.

I've been thinking about this one a lot lately. I've been doing a one year masters where I'm taking two courses a semester and doing research. The depth with which I am learning things is _night and day_ compared to the depth with which I learned my undergrad material. During undergrad, I was drinking from a firehose and just trying not to drown. I would turn in unfinished problem sets, not having learned the material, and move on with my life. I would sleep through classes out of sheer exhaustion.

Now, with just two classes, I'm able to learn things almost well enough to teach them. So one way to improve retention is just to take things slower.

Another model comes to mind if we consider how people study at Cambridge, Oxford, etc. I have not experienced it myself, but according to students who went there as exchange students (and students from there who came here (here being MIT)) it's pretty different. Students here are overwhelmed with constant work. There, it is a lot more self paced, with a set of final examination at the end (someone please correct me if I am not doing it justice). So perhaps self-pacing and working smarter, not harder leads to more retention.

Do you know of any sources for retention statistics such as those you cited? Some of them don't match my experience (for example, I would say that I spent 8-10 hours a week in classes related to my major).

2) Courses need to happen in a logical sequence so that they can build on one another.

When I first read your post I thought you were suggesting that students should, by themselves, pick what to learn based on what they want to build, in lieu of being guided through a logical curriculum.

The point about scheduling gaps is interesting. Scheduling gaps happen because it's hard to satisfy the constraints of so many student and faculty schedules. If you could take courses on demand, that would fix things.

3) Results driven learning can be excellent for motivation and retention.

When one talks about results, there is a fundamental issue of time scale.

Courses that say things like "When you're done, you will have built an autonomous mobile robot" are great.

But there are many fundamental things to learn, over a long period of time, whose benefits

* you might not see for a long time * are broader than you could have ever imagined (and hence the benefit would seem artificially low to you)

If you as a student get to pick the desired result yourself all the time, you might be tempted to pick shorter-term results. This can be catastrophic to your education.

I believe in forcing people to learn fundamentals of their chosen field --- fundamentals whose power they might not appreciate until later. Learning fundamentals (that you might choose not to learn if you weren't forced to) is fruitful in powerful and unexpected ways.

Take pure math classes. You learn analysis. Then you learn measure theory. Then you learn measure-theoretic probability theory. Then you learn stochastic processes. All of a sudden, financial mathematics becomes easy to grasp. But so do a host of other things. Signal processing, computer vision, statistical mechanics, complex multiagent systems, epidemic modeling, control systems.

I suppose you could have started on this path because you wanted to learn financial mathematics. But it probably would have seemed way too complicated and difficult. But if someone says they want to be an applied mathematician (a much "broader" and more long term goal than just learning financial mathematics), then they'd better take a ton of pure math.

<comment><AUTHOR> 1) There have been a few different experiments with self pacing and retention at schools like Oxford (and a college in Iowa of all places). The typical result is a significant increase in retention with lower stress. The problem, and fundamental reason why this isn't the norm, is simple logistics. Trying to build a serial system of education that still uses classrooms is massively difficult. The closest you can get is a compromised 6 week class system that is still extremely difficult to pull off. Parallel is just easier and more cost effective to administer. It's also easier and more cost effective to administer on an online system which is why the push for MOOC. The difference for us is that we care more about optimizing the learning process itself and real evaluation and guidance, and are willing to bet that enough students also care about those points to give us a chance at proving it at a large scale. Our system costs a little more than free, sure, but the difference in results can be dramatic, as you are seeing with your masters program.

I don't have the 7% study at hand, but I'll try to look through my list of references to see if I can track it down. They cover some statistics on retention in this article: [http://www.wired.com/medtech/health/magazine/16-05/ff_woznia...](http://www.wired.com/medtech/health/magazine/16-05/ff_wozniak?currentPage=all)

As for in-major hours, it may vary a bit by school (and MIT has a higher percentage than most), but here is the breakdown for UT. In-major credits required for a CS bachelors: 45. Average credits per class: 4. Weeks in a semester: 14. Average classes per week: 3. Total estimated lecture hours per class: 42ish. Total in major lecture hours for 45 credits: about 500. Subtract intro days, quiz and final days plus time for class to get settled, etc.. and you have somewhere around 400-450 hours left, or 100 per year, 2 per calendar year week or 3.5 per school year week. Some semesters you might not have any in major, some you might have 2 or 3, so remembering 8 hours in a week of classes is not outside of the data set.

2) A student should not have to know the exact set of skills necessary to build up to the higher level concepts. This is one of the problems with the self directed learning attempts in traditional schools. But, if the student has a clear end goal in mind (say, the goal of becoming a search engineer at Google), then a JIT system that can build a sequence of courses based on the concepts within the course is more effective and targeted than a standardized fire-hose curriculum. Speaking of fire-hose, I'm working on a post covering context switching in a parallel educational system that addresses exactly why this is such a problem.

3) This comes back around to the top down (or goal oriented) approach, and gets even more interesting with a mentor guided approach. Imagine a hybrid apprentice/mentor system where the mentor can define a sequence (or collection) of high level concepts which the learning system could then take and generate a path to master those concepts. All the while, the mentor could provide direct guidance and assistance where needed and help answer the tough questions that arise without having to dedicate all their time to the actual instruction. There are many, many, variations on this pattern that work extremely well with JIT systems but really don't work at all in JIC.

</comment></comment></comment></comment><comment><USER7> What does HN think of my prediction?

Within the next decade, we will see the rise of the teacher superstar. They will have salaries/compensations comparable to movie stars except their performance will be teaching online to massive amounts of students.

We can already see a beginning of that trend with Salman Khan or Peter Norvig teaching an AI class online.

<comment><USER8> Optimistically, I think it'd be a great thing if this (or even some portion of it) came to pass.

Two thoughts come to mind:

1) Salman Khan is arguably this already (although he's not a "teacher" in the narrow, institutional sense) - he's managed to educate thousands of students rapidly, and he's raised a significant amount of capital for Khan Academy (not to mention attracted quite a bit of media attention)

2) The best private schools, I suspect, house many potential "superstar" teachers. The problem is that the schools have most of the reputational value and reap almost all of the financial rewards. In a lot of ways, it's an information asymmetry problem; I attended such a school and had what I would imagine to be a very disproportionately high number of superstar teachers, but I didn't know which teachers were superstars until after I had enrolled in the school and taken their courses.

</comment></comment><comment><USER9> Is anyone else surprised at the number of frontpage articles name-checking pg this week?

<comment><AUTHOR> The way I look at it, he name checked us, he just didn't know our name yet.

</comment></comment><comment><USER10> I'm not sure I follow. Am I supposed to pay $10k for an online course that I know little about their reputation, with no free trial nor guarantee from existing businesses that they actually value your certification? It's hard to imagine how you'd get early adopters to get traction.

I think you're looking at it wrong. You shouldn't be comparing yourself to universities. Don't compare your prices, duration and accreditation with them. You should be building something completely different from the ground up. Something that is viable in today's world, not trying to bandage existing university models to today's world. Like pg said, build your own thing, if it's really good, it will eventually replace universities without you even aiming for that.

Personally, I think you should focus much more heavily on the accreditation side than anything else. Just try to build a certification system together with existing tech employers, something that they would sign and put a banner in your website saying "company X approves this certificate as important for our selection process". _That_ would get early adopters interested. After you have that. Offer your classes for free, make those as widely available as possible. Charge for the certificate and one on one help with those who feel they need it to get your certificate. Well, that's how I think this universities will actually get disrupted.

<comment><USER11> I'd actually focus more on reputation for delivering results than accreditation. Accreditation is a massive bureaucratic nightmare and I'm not sure it's worth it. For access to Title IV, maybe, but it's going to seriously cost you in other ways, slowing you down on a 1000 fronts.

I don't think you can beat the current universities by playing the game by the rules they've set up to manage their competition. Just seems like you've lost before you've even started.

<comment><AUTHOR> We actually have to focus on results first and foremost. By the time we can even apply for accreditation (probably 3 years out) the issue of accreditation for reputation will be moot.

But, you have to look at what the larger impact can be with accreditation and Title IV. Even though we are strongly against student loans, being able to work with state and federal governments for grant and work study funds is the best and most direct way we have at hitting "free education for all" status. It's also the quickest way to move out of the relatively small group of students who don't care about accreditation to reach the much larger group that does. It's only by being a reasonable alternative to this group of students that we can apply real pressure to the current system. As long as we aren't accredited, the existing institutions can simply point to that fact and write us off and most people will listen to them.

</comment></comment></comment><comment><USER12> It doesn't quite meet your criteria for start today, but the Open University, a well respected "virtual uni", has been running in the UK for over 40 years.

<http://www.open.ac.uk/>

Fees are a little higher but only marginally at around $8000 per 120 credits for international students. (A typical degree requires 300-360 credits)

Many degrees can be completed over 7 or more years if it's convenient. But I think there is a minimum time as some coursework is assessed to a schedule.

So there is definitely a market for this type of learning, and competition almost always benefits the customer, so good luck!

<comment><AUTHOR> OU was a big inspiration for us. The bar we personally use is building a system designed for Silicon Valley. Pacing and availability are critical, as is maintaining a very high standard for classes. Right now, OU doesn't meet either requirement. (their SE program, for example, is little more than a few intro to Java classes and some SE theory)

</comment></comment><comment><USER13> Regarding the point: "Just-in-time learning is the future. No ifs, ands, or buts. Any argument you might have to the contrary is not only wrong, but dangerously wrong."

I don't think I agree with you there (or perhaps I just didn't interpret the point correctly). In certain fields of study - and perhaps software engineering is one - this might be true, but it does not hold generally. If tomorrow I find myself needing to write a good zero-finding algorithm in a new language, then yes, I can probably absorb that material quickly. If I find myself needing to model the temperature dependence of something using an esoteric branch of quantum mechanics, then good luck to me without 3 years of prior study in topics that didn't seem relevant to anything at the time.

</comment><comment><USER14> This is very very a long shot project. I have watched colleges trying to get their first accreditation (I guess most likely going to be DETC in that case), but it is really a difficult process which gives them very little room outside of following the existing for-profit college business model. Plus the pricing is another issue. For example via distance CS Master Degrees at state colleges can go for under $10.000 (Columbus State, Dakota State). The other more important thing is brand building. And developing Top Education brand burns lots of money and time. But it is exciting to watch the new approaches to Education grow. Hopefully one or another are able to break out.

<comment><AUTHOR> No arguments on the long shot part, and you're right, focusing on accreditation does put some serious limitations on exactly how we can structure our business model. Not focusing on accreditation, however, means it is very easy to create a business model that is impossible to accredit. Udemy, for example, will never be able to achieve their original vision of being a real college or university because their business model relies so heavily on revenue sharing for the instructors, which is a big no no for accreditation boards.

Cost is actually the one area where we can compete very aggressively. Columbus state may be able to sneak under the $10k mark, but for an equivalent program we'll be just over $3k with a much more flexible and adaptable system. That number, btw, is with state and federal subsidies for the school, often upwards of $10,000 per student per year. We're coming in completely unsubsidized at a price that's less than a third of our cheapest competition with an offering that is significantly higher quality (we're competing with MIT for some of our professors).

Brand building really is the toughest nut to crack, and one what we have a couple different strategies for. Not really comfortable discussing those strategies on this forum, but let's just say we've thought a great deal about the problem.

<comment><USER15> Isn't the traditional way to get a new college accredited to buy an existing, economically failing school which is already accredited and take over the credential?

<comment><AUTHOR> Sure, it's traditional if you are unable to meet accreditation standards on your own and have a spare $10mil in the bank. We can meet those standards on our own, however, we don't have a spare $10mil in the bank.

</comment></comment></comment></comment><comment><USER16> A similar discussion/blog post in a thread on another trending HN post:

<http://news.ycombinator.com/item?id=3742455>

Maybe we're all just seeing an end to the vague rhetoric about college "preparing you for life" rather than training you for the workplace.

</comment><comment><USER17> That's really cool. Unfortunately, I'm not willing to drop $400 for an online course of unknown quality, with uncertainty about accredidation, when coursera is free. How do you plan to attract your initial users?

<comment><AUTHOR> The best way we can attract our first users is with having a course that is so valuable for our students that accreditation concerns become secondary. In this case, if you are looking for a high level class in Web App for Mobile, you probably will never find it in the coursera, mitx, udacity or khan catalogs. They have no interest or incentive to put that sort of course together.

If you look at the value proposition for a student, our web app class is extremely high. The material covered in that class can have a direct impact on job prospects, billing rates, or internal promotion opportunities, and it is such a difficult area to self teach that saving tens or hundreds of hours fighting though online tutorials is well worth the $200 or $400 that the class costs.

<comment><USER17> How do I know it's high quality, though? $400 is a significant amount of money. Without user testimonials or reviews, am I supposed to take it on blind faith that it will be worth my $$?

I'm not slagging you, by the way. Just offering my initial reaction as someone who _would_ be interested in such a class, who _is_ doing a CS degree at a traditional university, and who _would_ like to see someone disrupt the higher education model.

<comment><AUTHOR> As soon as we have users, we'll have user testimonials and reviews. It's part chicken and egg, I know, but it's the same problem any new product has. Someone has to be the first.

Other than user reviews (and the free preview and money back guarantee), what could we do to convince you (or other prospective students in your position) that it's worth the risk? Would a google hangout with Dr. Ostrowski (something we have been talking about) make a difference ?

<comment><USER17> >free preview and money back guarantee

Make this more prominent; I didn't see any mention of it. Just "Give us $400 for our awesome class".

>Would a google hangout with Dr. Ostrowski make a difference ?

Absolutely. An AMA wouldn't hurt, either. Also, sign me up for your newsletter. Email's in my profile.

<comment><AUTHOR> Thanks for the advice, We'll definitely work on making our guarantee more prominent.

I've been considering an AMA on Reddit, even though I actually had to quit the site three months ago to get to where we are. AMAs on HN are a little tricky as the commenting system is so...unique.

Either way, I'll add your email and keep you updated.

<comment><USER17> HN AMAs unfortunately seem to be a non-starter. I can definitely sympathize with blocking reddit for productivity reasons, but it's a connection with your target market that shouldn't be ignored.

I like your idea, and I love your goal, but it's going to take more than that to make me a customer who forks over hundreds of dollars. You've got the attention of the technorati; I'd first focus on how you can convert _them_ to paying customers, then deal with the plebs later.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> I think this would actually work better as a quick reference for people who are already coders - sometimes you just need to look stuff up. Target Stack Overflow rather than Stanford.

<comment><AUTHOR> Excellent point, and a strategy we have built in the learning system part itself. As odd as it may sound though, I actually wouldn't want to go up against Stack Overflow. They are a much more dangerous competitor than Stanford.

</comment></comment><comment><USER19> Why is your blog completely unusable without javascript enabled?

<comment><AUTHOR> It's blogger. Not really something we have control over.

<comment><USER20> You choose the platform you publish on, though.

I always browse without javascript enabled. Sites that load, and/or warn me correctly get a subtle mental nod and (maybe) even an addition to my safe- list. Obviously a blank white page isn't going to bring anyone back a second time...</comment></comment></comment>


Soli: ubiquitous gesture sensing with millimeter wave radar (2016)[pdf] - <AUTHOR> http://dl.acm.org/citation.cfm?id=2925953&CFID=891255666&CFTOKEN=94926193 <comment><USER2> The link is broken for me (403).

edit: this link seems to work [https://dl.acm.org/citation.cfm?id=2925953](https://dl.acm.org/citation.cfm?id=2925953)

<comment><AUTHOR> wish I could update the url, can only edit the title :/

<comment><USER2> A mod can do that for you.

</comment></comment></comment><comment><USER3> This is cool _work_ ; however, whoever approved this as _PUBLICATION_ should be shot.

No software in sight. This is _especially_ bad since "machine learning" is cited as a cornerstone of the detection. Hardware papers behind paywall or not yet existing (and may never exist). Nothing even remotely useful for somebody to replicate or evaluate.

If this appeared on the web from a company other than Google, everybody would dismiss it as pure marketing fiction.

Maybe I'm being overly harsh, but one of the big problems with 60GHz type stuff is evaluation that what you have is reliably signal. Especially with "machine learning", who knows _what_ the system is latching onto.

<comment><USER4> Have you seen the demonstration videos? Some of the applications look really cool and useful, and the hardware is in a pretty advanced state.

See [https://www.youtube.com/watch?v=H41A_IWZwZI](https://www.youtube.com/watch?v=H41A_IWZwZI)

</comment></comment><comment><USER5>
      (2016)

C'mon, man. It's been less than twelve months.

2016 was three weeks ago.

</comment><comment><USER6> Given the accuracy, could it read your fingerprints while you're doing the gesture? From the paper, it looks like the average displacement accuracy is 0.4mm. I wonder if that's accurate enough to read your fingerprints. If it could, you could ensure that only your gestures are recognized and not someone elses!

<comment><AUTHOR> Well, resolution for fingerprint scanners is roughly 500 dpi [0]; 1 in^2 = 645 mm^2; so.. maybe, I'm not sure!

But, that said, I believe there are many >1 mm^2 resolution features that can basically uniquely identify users, like, the shape of a hand (individual finger geometry, etc), the length of a limb, the particular subcutaneous layout of veins, face geometry, etc. It's interesting to ponder about, at least!

Currently looking around for cheap (and arduino-amenable) single chip radar systems whereby I might try to hack together a more low tech prototype of Soli

[0] [http://www.neurotechnology.com/cgi-bin/fingerprint- scanners....](http://www.neurotechnology.com/cgi-bin/fingerprint-scanners.cgi)

<comment><USER7> Or even a special carved ring, or sticker or something.

</comment></comment></comment><comment><USER8> Video of the "thing" :

[https://atap.google.com/#project-soli](https://atap.google.com/#project-soli)</comment>


Time management techniques you likely didn't know: Salami,Pomodoro,SwissCheese - <AUTHOR> http://blog.casual.pm/post/114499949915/time-management-techniques-salami-pomodoro

<comment><USER2> I know Pomodoro (most of us do i think), don't know the rest. I first thought this was an April fools though, but its posted a week ago.

Wikipedia can only help me with Pomodoro also ;)</comment>


F--k. The Game - <AUTHOR> https://www.kickstarter.com/projects/1443373368/f-k-the-game

<comment><USER2> This is a cool idea, I've backed it and I want a packet!</comment>


Our team of two developed a simple Bank Statement Parser - <AUTHOR> http://www.inkredo.in/blog/developing-a-bank-statement-analyser <comment><AUTHOR> We're working with small businesses to help them get access to working capital. We digitise their transactions with big suppliers and in turn fund their inventory.

Two months back we were almost about to integrate a bank statement parser that would cost us an installation of $3200 and additional $2 for each call. Since we didn't find any other parser that catered to all the major banks in India, we developed this.</comment>


Ironies of Automation (1983) [pdf] - <AUTHOR> https://www.ise.ncsu.edu/wp-content/uploads/2017/02/Bainbridge_1983_Automatica.pdf <comment><USER2> Some newer papers looking back at this and it's continuing relevance:

2017: _Ironies of Automation: Still Unresolved After All These Years_ [https://doi.org/10.1109/THMS.2017.2732506](https://doi.org/10.1109/THMS.2017.2732506) (couldn't find an openly accessible link :/)

2012: _The ironies of automation... still going strong at 30?_ \- [http://johnrooksby.org/papers/ECCE2012_baxter_ironies.pdf](http://johnrooksby.org/papers/ECCE2012_baxter_ironies.pdf)

<comment><USER3> [http://sci-hub.tw/https://ieeexplore.ieee.org/document/80130...](http://sci- hub.tw/https://ieeexplore.ieee.org/document/8013079)

</comment></comment><comment><USER4> I used to work in ETL sometime back on a popular tool daily.

It used to take a LOT of time for doing code reviews.

30min per object. Decent project has 300 such objects.

Turns out the tool can export in XML so I wrote a Python script to do the review.

What happened?

I could review basic manual things like coding standards in 15milli seconds irrespective of the object number.

That's automation. It is usable in other projects , and nobody other than my team used it ever for review. Why? Because it requires efforts to understand & a basic understanding of XML &Python and they don't have it because it's not their field. I am a nerd so I kept exploring.

So the script is now ancient history.

And coming to my point. These people say automation is demise of everything. AI is taking over all jobs. Won't happen for a long time.

For starters, scientists in the cold war had said "We will have live voice translate from Russian to English in 5yrs"

Cold war has ended for how many years now? And in 2010s MS finally was able to bring this tech. Imagine the time gap.

secondly, if such an 'automation' thing is sold by a company, then who will create & sell it? And will that firm have 1000000000 of such small scripts for automation? Highly unlikely. Whatever automation I did in past five years was something that relieved my work load.

It is highly unlikely that such automation packages will be bought by companies and the much harder thing is for automation companies to _sell_ such tools.

Companies like mine have spent millions to buy that tool, will they really spend more money on buying a bunch of automation tools?

Note that the core aspect of the tool's usage can't be automated . You still need a living thinking human being to use it, and make objects using the non existing requirement documents. Scripts need 100% perfect everything which is not possible in real life

</comment><comment><USER5> Yeah, unfortunately it's fairly easy to rebut this paper. I only had to read the abstract and the first paragraph. The last line of the first paragraph:

> ... the more advanced a control system is, so the more crucial may be the > contribution of the human operator.

This is absolutely true. The human operator working with an automation system needs to be way more skilled, more educated, and smarter compared to a human working as a cog in a sweatshop.

But this still doesn't support the thesis that it expands the problems associated with human operator, for the very simple reason:

You are replacing 1000 low-skilled sweatshop workers with 5-10 (or less) highly-skilled engineers and experienced technicians. And at the same time increasing the throughput of your production system by an order of magnitude or more. It's a complete win.

And I didn't even need to invoke the role and/or potential of modern AI (i.e., one based on ML/DL/DRL/CV etc, etc), which is going to take the automation to the next level.

Highly recommended watch: CGPGrey 'Humans Need Not Apply'

[https://www.youtube.com/watch?v=7Pq-S557XQU](https://www.youtube.com/watch?v=7Pq-S557XQU)

(in the video just look at the human labor chart regarding agriculture, at 15 second mark, and you'll understand what I'm saying).

<comment><USER6> > this still doesn't support the thesis that it expands the problems > associated with human operator

In some circumstances it might. Look at Air France Flight 447 and the role of the co-pilot in stalling the aircraft.

 _" Neither weather nor malfunction doomed AF447, nor a complex chain of error, but a simple but persistent mistake on the part of one of the pilots" _[0]

An aircraft like that has so many highly automated systems it is impossible for the human operators to fully understand them.

[0] [https://www.popularmechanics.com/flight/a3115/what-really- ha...](https://www.popularmechanics.com/flight/a3115/what-really-happened- aboard-air-france-447-6611877/)

<comment><USER7> > An aircraft like that has so many highly automated systems it is impossible > for the human operators to fully understand them.

The aircraft was stalling because the pilot kept the flight stick pulled all the way back. Nothing automated or complex about it - a wood-and-canvas biplane would have had exactly the same problem.

<comment><USER2> If I remember correctly: Due to sensor issues the plane dropped out of autopilot and switched into a different control mode ("Alternate law").

The pilot had to suddenly take over and had a wrong mental model of the state and configuration the plane was in, and likely didn't realize the consequences of the different control mode, among which is that it doesn't provide the same level of automated stall protection as the normal case. Since automation normally works, the pilot wasn't trained or experienced in flying in this mode.

While in the end the operator made the wrong decision, these automation ironies fit very well contribute to _why_ he made those decisions or wasn't prepared to make the right ones.

<comment><USER7> > While in the end the operator made the wrong decision, these automation > ironies fit very well contribute to why he made those decisions or wasn't > prepared to make the right ones.

Not at all convinced. Hauling back on the stick and just keeping it there would never have been the right decision under any circumstances. At the same time it's a reasonably common panic reaction, and was long before any kind of cockpit automation.

A pilot who had been in tense situations before would have been more likely to make the right decision, sure, and modern automated systems may well mean that the first truly deadly situation occurs later in a pilot's career than it might otherwise. But by definition there's no safe way to test how a pilot will handle genuine danger.

<comment><USER6> >> Hauling back on the stick and just keeping it there would never have been the right decision under any circumstances.

From the BEA report [0]:

"The horizontal bar then indicated a slight nose-up order compared with the aeroplane symbol."

and

"Nevertheless, the PF was also confronted with the stall warning, which conflicted with his impression of an overspeed. The transient activations of the warning after the autopilot disconnection may have caused the crew to doubt its credibility.

Furthermore, _the fact that the flight director was advising a nose-up attitude_ may have confirmed the PF's belief that the stall warning was not relevant"

(my highlight)

[0] [https://www.bea.aero/docspa/2009/f-cp090601.en/pdf/f-cp09060...](https://www.bea.aero/docspa/2009/f-cp090601.en/pdf/f-cp090601.en.pdf)

</comment></comment></comment></comment></comment></comment><comment><USER8> Should add (1983).

</comment><comment><USER9> Is there some LaTeX library to have your PDF show up like its been through the printer/scanner at least twice?

On a serious note, why do academics do this? It doesn't help me with readability.

<comment><USER2> Is it really that surprising that they don't have a crisp source PDF for a paper from 1983?

<comment><USER9> My mistake. Didn't notice that.</comment></comment></comment>


Side-channel attacking browsers through CSS3 features - <AUTHOR> https://www.evonide.com/side-channel-attacking-browsers-through-css3-features/ <comment><USER2> Equally worth surfacing:

      Habalov reported the bug to Google and Mozilla engineers,
      who fixed the issue in Chrome 63 and Firefox 60.

      "The bug was addressed by vectorizing the blend mode
      computations," Habalov said. Safari's implementation
      of CSS3 mix-blend-mode was not affected as the blend
      mode operations were already vectorized.

<comment><USER3> Block quotes are unreadable on mobile, so here's the unformatted text:

Habalov reported the bug to Google and Mozilla engineers, who fixed the issue in Chrome 63 and Firefox 60.

"The bug was addressed by vectorizing the blend mode computations," Habalov said. Safari's implementation of CSS3 mix-blend-mode was not affected as the blend mode operations were already vectorized.

<comment><USER4> I agree and it's annoying. Is there an easy way to fix that?

<comment><USER5> When posting a quote, don't indent the text. Just prepend '> ' instead, like this:

> I agree and it's annoying. Is there an easy way to fix that?

Readable on mobile, and makes clear what is/isn't a quote.

</comment></comment></comment></comment><comment><USER6> There is a similar vulnerability with `mix-blend-mode` that enables a script to check whether a user has visited any given URL. It has existed since as early as 2016 and is still a problem today in Chrome 67. See: [https://lcamtuf.blogspot.com/2016/08/css-mix-blend-mode- is-b...](https://lcamtuf.blogspot.com/2016/08/css-mix-blend-mode-is-bad-for- keeping.html)

And here is a demo: [http://lcamtuf.coredump.cx/whack/](http://lcamtuf.coredump.cx/whack/)

It has limitations which make it slightly impractical to check against a large number of sites but it's still surprising to see this hasn't been fixed.

<comment><USER7> That's very broken. It misses lots of websites I did visit and shows me websites I did not visit as though I did.

<comment><USER8> Make sure to clock the visible mole, not elsewhere in the page

<comment><USER9> Does not matter. This attack has not work since 2016.

<comment><USER10> Works in Firefox Nightly 62.0a1 very reliably

</comment></comment></comment></comment></comment><comment><USER11> This goes beyond just identification to actual data leakage, but ties into a larger point about GDPR and other regulations that we've been discussing ad nauseum here, which is questions like: "Why don't the GDPR regs just tell me what I need to do?"

The GDPR being deliberately vague is a response to issues like these, it serves neither the interests of the users or the regulation to say "Get consent before getting cookies and only cookies" only to have sites and services turn around and use methods like this, or:

BrowserFingerprinting - [https://panopticlick.eff.org/](https://panopticlick.eff.org/)

Super/Ever Cookies - [https://github.com/samyk/evercookie](https://github.com/samyk/evercookie)

HSTS identification - [https://www.owasp.org/index.php/HTTP_Strict_Transport_Securi...](https://www.owasp.org/index.php/HTTP_Strict_Transport_Security_Cheat_Sheet)

or whatever the new sneaky identification via browser features hack happens to be.

<comment><USER12> The whole "tell users we're using cookies" thing is idiotic -- every site uses cookies, and that's fine. The trouble lies not in the site's use of cookies, but in the use of cookies by third-party content providers used by the site.

It's the FB, Twitter, and other "like" and "share" buttons that are the problem.

<comment><USER11> This is kind of the subtlety that I'm getting at here: what the GDPR says is you need to say how you (as a controller operating a website) are tracking people.

Because the minute you throw down a technical rule it's trivial to route around it. Case in point: say you allowed only 1st party cookies (as defined by cross domain browser behavior and cookie setting). I could setup a CNAME for analytics.my-domain.com that points to FB's ad retargeting servers and they could include in the actual cookie data my id, ip or whatever else they'd need to lookup a user's information across domains.

Same with IPs: every GDPR discussion devolves into someone saying: "Well every site uses IPs! We have them in our logs, etc.! It's stupid to say that they're personal data" Which is how I thought of them until getting a glimpse into some of the ad networks/bidding where they are treated as more or less a currency for targeting, demographics, etc.

With GDPR it's not the data it's what done with the data.

<comment><USER12> I mean, there's nothing wrong with statutes and regulations being worded generally as long as they are not vague. Getting too prescriptive in this particular context would be counterproductive as the technology issues change over time.

What GDPR should say: things like "do not allow third-parties to track your users" or "warn users about third-party tracking". That would be exceedingly clear and actionable.

Now, "do not allow third-parties to track your users" might require some additional regarding implementation via contractual clauses. For example, if site A uses resources from site B and has a contract with B stipulating non- tracking of A's users, is that good enough? What if B is outside the EU? And so on. But aside from such side issues, "do not allow third-parties to track your users" is trivial to implement: a) only embed resources from third- parties that agree not to track your users, b) do not embed resources from any other third-parties.

"Warn users about third-party tracking" is even easier to implement: if you embed resources from third parties, you must warn.

> With GDPR it's not the data it's what done with the data.

Good! You can use contracts to manage this with all the third-parties you deal with.

Now, what about links to [non-embedded] external resources? We must not kill the web.

<comment><USER11> Ok, so you're describing (IMO) exactly what's in the text of the GDPR.

Here is a "plain english" translation of the GDPR that makes much of this more evident:

[https://blog.varonis.com/gdpr-requirements-list-in-plain- eng...](https://blog.varonis.com/gdpr-requirements-list-in-plain-english/)

If you dig into it, I think you'll find it lines up nicely with what you are suggesting.

</comment></comment></comment></comment></comment><comment><USER13> The gist of it is that there's a timing attack on fancy stacks of blending modes. Calculating a final pixel color takes different amounts of time for different underlying pixels. So javascript can "scan" and OCR a page, or an iframe in that page.

<comment><USER14> All doors are open for side channel leaks. Having programs run on your machine is like having someone watch your computer. The issue is how to control the exfiltration of that data from you computer. That's where the sandbox should be focused on.

<comment><USER15> Not sure why this is being downvoted. I admit that I find it hard to see how to control the exfiltration of data once it's been figured out by a badly sandboxed program. But the idea that systematically addressing side channel attacks in a sandbox is really hard seems very valid. I mean, the exploit described in TFA is quite the argument in favor of this point.

</comment></comment></comment><comment><USER16> It's surprising to me that anything should be allowed to overlap on top of iframes. This seems to be a continuous vector for other security issues, such as fake buttons over the Facebook "Like" button, etc.

<comment><USER17> That would break a lot of things. For example you couldn't use a modal on a site that had a facebook like button on it.

Click jacking is generally avoided by the `X-FRAME-OPTIONS` header or the CSP frame-ancestors option.

<comment><USER18> Are you sure? Maybe the modal couldn't cover the Like button and it might be weird if the user could still click Like while your modal is up but it wouldn't _break_ your page if this were the case.

<comment><USER17> I don't understand what you are proposing. If the modal can't cover the like button, how would you implement a modal? How would you implement the standard background fade when a modal is open (which is a div covering the entire page)? How would you propose implementing this change such that it doesn't require millions of websites to change their code?

<comment><USER18> A full background fade is an aesthetic thing at best, and it would be disingenuous to fully fade a page if some parts are not in fact blocked (i.e. remain clickable). So I think it would require no changes, it would just look different.

Having said that, I see no reason to support Like buttons OR modals and I would be fine with millions of sites being forced never to use them. We know Facebook Like buttons are over-engineered trackers whose domains are best blocked at your router. And when modals are not being abused for things users don't want, the remaining "good" uses for modals would still be better implemented as less-intrusive and more-asynchronous things (display a modeless background message with buttons, for example).

<comment><USER19> It seems to me that you've never worked at a company with a marketing team.

</comment></comment></comment></comment></comment></comment><comment><USER20> Alternative interpretation: Iframes are so overpowered and such an edge case for the browser's security models that they cause constant issues with the rest of the reasonable browser spec.

<comment><USER21> Iframes will never go away.

But we need a way to tell a browser "if you embed this page into an iframe, it needs to be the topmost content, no transform/translate/visibility or anything". Social/login iframe would set that flag, and it would prevent the clickjacks and attacks like this.

<comment><USER22> All websites are supposed to set the header X-Frame-Options: DENY to block iframes. It's a solved problem.

<comment><USER23> That doesn't solve the issue of clickjacking attempts on pages meant to be in iframes (FB like buttons are in iframes)

</comment></comment></comment></comment><comment><USER24> Worth noting that this general category of render-timing-based pixel-reading has been around for a while. e.g. [https://www.contextis.com/media/downloads/Pixel_Perfect_Timi...](https://www.contextis.com/media/downloads/Pixel_Perfect_Timing_Attacks_with_HTML5_Whitepaper.pdf) is from 2013, uses svg instead, and I could swear I've seen a CSS one from a few years ago.

I really suspect there's only one fix, and it seems reasonable to me: don't allow sites to place content over iframes, period. Allowing it opens all kinds of exploits like this and various flavors of clickjacking, all basically un- preventable since there's no limit to the techniques possible.

</comment><comment><USER25> I don't think this can really be blamed on CSS. I mean, yes, a new CSS feature allowed a timing attack that could extract information, but these kinds of issues keep on coming up time and time again, meaning that it's not this particular CSS feature that should be blamed.

The issue is the ability to interact in any way with cross site resources which contain any kind of potentially sensitive information. This leads to things like clickjacking attacks, CSRF, information leaks like this, and so on.

The things that could be done to fix it:

1\. Don't allow any kind of cross-site embedding (yeah, this isn't going to happen) 2\. Treat any kind of cross-site embedding like private browsing mode; don't ever send any credentials along with it 3\. Don't allow the embedding site to interact in any way with embedded content. Treat it like an entirely separate, opaque layer above everything else, not subject to layering anything over it

Of course, I don't think any of these are actually going to happen, because they'd break too much. But otherwise, it's going to be a game of whack-a-mole with information leaks, new kinds of clickjacking and CSRF, and so on.

<comment><USER26> > 3\. Don't allow the embedding site to interact in any way with embedded > content. Treat it like an entirely separate, opaque layer above everything > else, not subject to layering anything over it

I'm actually surprised to hear that this is _not_ the fix here. Instead, they optimized the rendering code, which might not preclude more sophisticated attacks on that side channel.

<comment><USER27> As noted elsewhere, this would cause sites with models or menus to appear broken, when the menus or models are stuck behind the iframe. Yes I know, don't make sited with iframes and litghtboxes or whatever then, but people do, and the option they chose won't break those people.

</comment></comment></comment><comment><USER28> Building a powerful sandbox that maintains anonymity is a difficult problem. The statement that CSS is overpowered is clickbait for a _different_ argument.

</comment><comment><USER29> "Besides Habalov, another researcher named Max May independently discovered and reported this issue to Google in March 2017."

I wonder why they are fixing it now, when they didn't do anything for over a year

<comment><USER30> The disclosure is being _published_ now. From the timeline at the bottom of the article, it becomes clear that they only ignored the issue for 2 months.

That is still more than zero delay, but a bit more reasonable.

<comment><USER29> How is that? >"2017-12-06 Fixed with Chrome version 63.0

2018-05-15 Fixed with Firefox Quantum version 60.0" That's 9 months for Chrome and more than a year for FF Quantum?

<comment><USER31> But also "2017-11-26 Reported the vulnerability to Mozilla's VRP" because "due to some misunderstandings on our side, reporting the vulnerability to Mozilla was delayed".

So I think "more than a year" is a little unfair to Mozilla.

</comment></comment></comment></comment><comment><USER32> Url changed from [https://www.bleepingcomputer.com/news/security/css-is-so- ove...](https://www.bleepingcomputer.com/news/security/css-is-so-overpowered- it-can-deanonymize-facebook-users/), which points to this.

</comment><comment><USER33> This is really a timing side channel attack. Such side channel attacks have been known about for a long time but this one allowed you to leak information about the color of a single pixel in your target page. I wouldn't say this is due to CSS being overpowered, it is much more due to the way that iframes can be configured to show a single pixel and the way that rendering times for your page are leaked into JavaScript. If your rendering is not done in constant time then the vulnerability occurs and CSS in this case allowed you to trigger non constant time rendering. The fix was to make the rendering constant time again.

</comment><comment><USER34> This line particularly caught my eye:

> It was quite surprising for us to find out that the blend mode layers were > able to interact with cross-origin iframes in the first place so we > investigated this further.

Because a few years ago I was wondering the same thing; Someone figured out a side-channel timing attack using SVG filters, exploiting differing execution times of code paths in the Erode filter (probably also in the Dilate filter but they only needed one). IIRC, they could even apply it to an iframe with a source:// URL of another domain (probably FB again), of which they could control the scrollbars and scroll into view the session key that showed up in the HTML source somewhere. This raised a couple of questions with me ...

Why can we put a source:// URL in an iframe at all? Why can we control the scrolled position of content in a cross-domain iframe? And why are SVG filters capable of processing cross-domain content instead of just seeing a black square or something?

AFAIK they fixed it by changing the filters, making sure all code-paths were of equal length. Which is part of the right solution because side-channel attacks can come from anywhere (it's kind of their thing). But making the whole system more robust by just not allowing _operations_ on cross-domain content would do a whole lot for plugging many of these bugs.

I'm kinda surprised there haven't been a lot more of these. Could be I've missed them though.

</comment><comment><USER35> This is a really interesting vulnerability, and really interesting research, but the clickbait title-with-an-agenda is really terrible. Can we change it?

</comment><comment><USER36> > Habalov says that depending on the time needed to render the entire stack of > DIVs, an attacker can determine the color of that pixel shown on the user's > screen.

I wonder how this is the case?

Anyway, lots of interesting vulnerabilities of late that utilize the measurable time of computations, and use it to reconstruct data. I think that type of "lossy attack" is so cool and creative.

<comment><USER13> A fancy darkening algorithm on #000 can be short-circuited. I don't know if that's precisely what's going on here, but it's a general example.

</comment></comment><comment><USER37> This isn't the first time a color-exfiltration vulnerability has been found in CSS. Disappointing that we're revisiting this same issue.

<comment><USER38> I believe this is also why there's not a CSS equivalent of Adobe's Pixel Bender shader system.

They're worried that someone could write a shader that would detect sensitive info (like a credit card number) and jank the render thread in an observable way to leak the number to a script running in the parent window.

<comment><USER8> Actually, CSS shaders are a thing, but can't access DOM content pixels for exactly that reason.

[http://alteredqualia.com/css-shaders/article/](http://alteredqualia.com/css- shaders/article/)

</comment></comment></comment><comment><USER39> Expecting browsers to prevent cross-site exfiltration and tracking is pretty iffy. When it really matters, even preventing that at machine level is pretty iffy.

Compartmentalization among multiple machines is better. Maybe sandboxing aka light virtualization can be adequate. But I'd rather go with at least full virtualization. And when it really matters, I use multiple hosts, with network isolation.

</comment><comment><USER40> I am fine with locking down cross-origin iframes, but one major annoyance is the inability to detect whether the iframe has a scrollbar and if so, adjust the size until it doesn't have one. I really wish that there was a "height: auto" property for iframes that automatically adjusted the height so that it didn't need a scrollbar.

<comment><USER21> Once upon a time the specs planned a <iframe seamless>, but unfortunately it was never widely implemented. Probably because it also tried to do things like letting the outer CSS leak into the seamless frame.

</comment></comment><comment><USER41> Short of something drastic like Lynx, is there a good dumbed-down browser from a reputable source? It feels like there's no good check on site complexity. The security risk, but also the absolutely embarrassing resource consumption is almost too much to bear.

<comment><USER42> You don't realize it, but by saying this you are rejecting the modern Web (insert horror screams here). So maybe try the old passive web: Gopher.

<comment><USER41> Hah, maybe a middle ground vs gopher. The GDPR mitigation from NPR ([https://text.npr.org/](https://text.npr.org/)) was refreshing. The amount of effort for display capabilities above and beyond moving around plain old text + some markup for layout has been totally out of proportion to the end-user value. I kind of wonder things like, "I wonder how much the memory/cpu it takes to run Slack (just on my laptop) vs total at NASA to design and managed the Apollo 11 mission". Anyway, that's OT enough. It's just that this is such a ridiculous vector that it's irritating.

<comment><USER43> text.npr.org is older than the GDPR

[https://news.ycombinator.com/item?id=15342758](https://news.ycombinator.com/item?id=15342758)

<comment><USER41> Thank you! I didn't know that.

</comment></comment></comment></comment></comment><comment><USER44> Now that is crafty.

</comment><comment><USER45> Is there a mirror? Site's down for me

<comment><USER13> [https://webcache.googleusercontent.com/search?q=cache:FoYSf9...](https://webcache.googleusercontent.com/search?q=cache:FoYSf9fZz9MJ:https://www.bleepingcomputer.com/news/security/css- is-so-overpowered-it-can-deanonymize-facebook- users/+&cd=1&hl=en&ct=clnk&gl=us)</comment></comment>


Open letter calling for the release of WikiLeaks publisher Julian Assange - <AUTHOR> https://defend.wikileaks.org/2020/07/03/open-letter-calling-for-the-release-of-wikileaks-publisher-julian-assange/ <comment><USER2> It does indeed seem that Assange has been (A) a Russian puppet, and (B) persecuted unjustly.

Even if Assange worked entirely at the direction of Russia, the Constitution of the USA explicitly prohibits laws that abridge the freedom of the press. If Assange was merely the publisher, rather than the leaker or hacker of classified information, then it's hard to argue that the USA government's position is apolitical in its nature. Indeed, that position would seem to be entirely dissociated from the most basic protections offered by USA law.

Politicians don't have infinite discretion to create laws where there are none, or to nullify legal protections that are explicitly stated in the Constitution. If they bag Assange and make an example of him, they do so at risk of diminishing the already strained rule of law in the USA.

Assange's persecution would be a huge win for Russia and China, because it would give those nations an opening to draw moral equivalence between their repressive actions and those of the USA.

On the other hand, Assange's persecution would do very little to dissuade future leakers and hackers, who will simply be more careful in choosing how to publish classified information.

The best thing for the USA to do would be to try Assange and find him "not guilty" if he was simply a publisher. The strength of the relationship between the USA, Britain, and Ecuador would be demonstrated, reinforcing American hegemony in Europe and Latin America. However, by reinforcing the inviolability of the First Amendment, the USA would rebuild some sense of exceptionalism among the world's powers. ("We're all powerful, but only the USA arrived at power with a healthy respect for human rights and strict adherence to the law above all.")

</comment><comment><USER3> Do not release this russian puppet

<comment><USER4> Posting unsubstantive flamebait will get you banned here, and unfortunately you've done it more than once before.

Perhaps you don't owe 'russian puppets' better, but you owe this community better if you're posting to it. No more of this please.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)</comment></comment>


Thinking Go is simple is considered harmful - <AUTHOR> https://go101.org/article/101-about.html <comment><USER2> Go _is_ simple in the sense that there is very little "magic", i.e. very little code that executed that might not be obvious right away: No constructors, no destructors[0], no operator overloading, etc. This makes relatively easy to get a reasonably-accurate mental model of what is going on. Perhaps more importantly, its community has a culture that encourages simplicity of design, avoiding fancy tricks, etc.

Using features like concurrency and interfaces in ways that are considered idiomatic is not exactly trivial, I think. But it's not that hard, either. At work, I have been using C# quite a bit lately, and while I think it is a well- designed language, it is _far_ more complex than Go ( _cough_ async _cough_ ).

I don't think what you are saying is wrong, but I think the title of the posting is easily misunderstood.

[0] IIRC, one can ask for a "cleanup" function to be called when an object is about to be harvested by the garbage collector, but one has to do so explicity, and from what I have seen, it is not used commonly.

<comment><AUTHOR> For the "cleanup", do you mean finalizers? The runtime.SetFanalizer was ever one of my confusions. [https://go101.org/article/unofficial- faq.html#finalizers](https://go101.org/article/unofficial-faq.html#finalizers)

<comment><USER2> Yes, I was thinking of finalizers.

To me, the main problem with them is that I have no control over when/if they get run. Fortunately, there is defer. ;-)

</comment></comment></comment><comment><USER3> Ugh. This is just a dumb ad for a dumb book.

Go is a simple language, one of the simplest.

<comment><USER4> I really want to use Go and I already know the language itself but this post[1] makes me scared to the point where a language as big as Scala makes more sense to me than learning a simple language but with a ton of things on the side to know. Is it really accurate compared to this post?

I feel like I will have more to learn with Scala but at least it will be useful things.

[1] [http://devs.cloudimmunity.com/gotchas-and-common-mistakes- in...](http://devs.cloudimmunity.com/gotchas-and-common-mistakes-in-go- golang/)

<comment><AUTHOR> I'm so sorry if this article scares you. This is not the intention of this article. In fact, Go is a relative simpler language comparing to many other popular static languages.

This article is intended to emphasize that you should NOT learn Go with the attitude by thinking Go is a very simple language.

</comment></comment></comment><comment><USER5> Go had, last I manually counted, a whopping _seventeen_ numeric types. That's a lot of complexity just in interpreting numeric literals!

<comment><USER6> The underlying types are exposed to you, like C.

Go isn't adding sugar to handling numeric types: it's not autoboxing to help you with conversions, and it's not hiding the implementation like a scripting language. I'll admit, it's a real pain when trying to convert from one type to another (e.g., in graphics programming, where I'm changing types from internal representations to what gets drawn to the screen). For most "job" programming, it was a non-issue and I felt secure in knowing what types, sizes, and representations I'm really using.

</comment></comment><comment><USER7> I have this overwhelming feeling Go will eventually take Java's spot in Tiobe, but it will likely take 10 years.

<comment><AUTHOR> same feeling.

</comment></comment><comment><USER8> Link to epub/mobi/pdf?

<comment><AUTHOR> There will be eventually. currently, you can visit the go101.org website. The website is designed mobile friendly.</comment></comment>


Linux Namespaces and Go Don't Mix - <AUTHOR> https://www.weave.works/blog/linux-namespaces-and-go-don-t-mix <comment><USER2> Particularly interesting, given that most of the software in the container space seems to be written in go: Docker, Kubernetes etc

<comment><USER3> Docker uses this workaround: [https://github.com/opencontainers/runc/tree/master/libcontai...](https://github.com/opencontainers/runc/tree/master/libcontainer/nsenter)

"The nsenter package registers a special init constructor that is called before the Go runtime has a chance to boot."

Kubernetes relies on CNI drivers which exit very soon after changing namespace; essentially they cross fingers and hope the problem won't strike.</comment></comment>


Ask HN:  What's on your summer reading list?   - <AUTHOR>

I'm a marketer turned developer, so Finishing Code Complete tops my list.  I also want to pick up a book on meditation.<p>What's on your list? <comment><USER2> I'm currently reading The Design of Everyday Things by Donald Norman. Even if you won't be doing much work on the design side, it's a great study in why things are made the way they are and what constitutes good/bad design.

</comment><comment><USER3> I used to be into meditation, but then decided it's also bogus voodoo stuff. However, I did enjoy reading Zen Mind, Beginner's Mind by Shunryu Suzuki.

<comment><AUTHOR> Haha - bogus voodoo stuff, reminds me of Papa Shango (any old school WWF fans in here?) <http://www.google.com/search?q=papa+shango>

</comment></comment><comment><USER4> \- Programming in Scala by Odersky \- The Data Warehouse by Kimball \- Web Analytics 2.0 by Kaushik \- Quality Score in High Resolution by Danuloff</comment>


How to become drastically faster at using the terminal - <AUTHOR> http://www.mokacoding.com/blog/terminal-aliases <comment><USER2> I dislike the idea of aliases. I like knowing what the flags do. If I go to another workstation of say a co-worker and she's not using my particular aliases then what? What I've done is learned my own DSL and not the commands.</comment>


Wikipedia, too complicated for the masses - <AUTHOR> http://www.bbc.co.uk/news/technology-12171977

<comment><USER2> Maybe it is ok for editing Wikipedia to be a little more complicated than leaving a comment on YouTube.

<comment><USER3> I don't think so. There are people which are way more visual than programmers.

I myself have refrained from contributing to Wikipedia because I didn't want to learn the syntax. Not wanting to break things, I just submitted some fixes here and there in the body of some articles.

</comment></comment><comment><USER4> I don't think it's the markup. I think it's the folks that revert any and all changes, the deletionists, and the bureaucracy in general.</comment>