How Wall Street recruits so many Ivy League grads - <AUTHOR> http://www.vox.com/2014/5/15/5720596/how-wall-street-recruits-so-many-insecure-ivy-league-grads <comment><USER2> It's like so obvious, if you've spent any time at all working for one of these places. Or heck, even interviewing with them.

Here's what it all boils down to: aside the quants, the genuinely alpha traders, and few other wonky actuarial types, most of the grunts (you know: the "analysts"... and the vast majority of the IT types) don't seem to be there, or to have any other propelling motive in life, other than: (1) the above-average salary, and (2) once you're in, you're pretty much guaranteed to do alright -- as long as you're willing to fit in, never even _think_ of rocking the boat, and be ready and willing to continually supplicate your superiors at all times.

Hence the ridiculously subdued style of dress (the dainty dress shoes, the blue and bland off-white shirts), and the curiously submissive demeanor of about 80% of the people you'll meet working there.

Oh, and that drug test, that everyone snickers about below their breath? Including your hiring manager? As everybody knows, it certainly isn't there out of any concern that you'd be abusing intoxicants (after all, you're more than welcome to get shitfaced on alcohol every night of the week -- which most nights you'll find yourself more or less needing to, to drown out the pain, and there sheer inanity of what you're asked to do).

It's there as a gesture of supplication and obedience -- nothing more. Getting you to drop your trousers, whip our your gear, and provide a "specimen" upon demand -- _just because your superiors told you to!_ \-- isn't an unfortunate side aspect of drug screening; it's the true purpose of the ritual -- the very end goal, in itself.

<comment><USER2> BTW: the point about drug testing applies to the handful of cool, geeky, "Agile" companies that adhere to this ridiculous practice, too.

In fact, a certain company by the name of Pivotal Labs comes to mind.

So -- anyone from Pivotal reading this? You're more than welcome to share your true thoughts about your employer's urine fetish, here and now -- safely and anonymously! On the off chance that upper management might actually care what you think about the topic, and perchance, take you seriously.

But heavens, don't do this while your frontline manager is standing nearby! You might get... _caught!_

<comment><USER3> This is the first that I've heard of Pivotal Labs requiring drug testing.

That makes me really sad - I thought the tech industry was free of this incredibly invasive, offensive, and counterproductive[0] practice.

Do you know any other tech companies that have these policies (particularly startups)? I wonder if this is an outlier or just a commonplace practice I've been unaware of.

[0] Because not all drugs remain detectable for the same amount of time, drug tests simply encourage use of drugs that are tougher to detect (if you use cocaine, amphetamines, DMT, or heroin on a Friday, it will all be gone from your system by Monday). Marijuana sits at the far other end of the spectrum - depending on the means of testing, it can be detectable weeks after use.

<comment><USER4> My understanding is that it is not uncommon for VCs to push their companies to start drug testing. Can't vouch for exactly why that is, but it seems to be something that happens.

<comment><USER5> Why do these VC's have shares in drug testing company's I can think of only a handful of job (outside of DV/TS clearance) that should be allowed to test there employees train drivers, airline pilots and so on.

Your MD doesn't have to have drug tests and they have access to the whole damm candy store.

</comment></comment></comment></comment></comment><comment><USER6> There exist several organizations which have the general template: Hello, academic high achiever. You've spent _your entire life_ in a series of meritocratic competitions. You're socialized to seek the validation of decisionmakers above you, by hewing exactly to their published rubrics. This is gives you a powerful sense of self-worth, brings you status with your peers, and makes your parents feel like you've finally made it.

And now you're graduating from undergrad. And there's a wild, crazy world out there. And many processes in it are not judged by meritocratic competitions.

#%(& that noise. Come do our program. It's like everything you've ever done in life, except this time you'll be paid. Here's the application form, format for the essay, and description of the interview.

For a certain psychograph of young people, surrogate teachers at surrogate schools offering surrogate classes after surrogate admissions processes are _incredibly compelling_. (I rush to say that I fit this to the nines after graduation. My first job was an academic appointment and my second used exactly the above playbook to sell a job opportunity I would never have had any interest in as a quasi-study abroad option.)

</comment><comment><USER7> Wall Street has a few features that make it very attractive to ambitious young people:

1) The money. The potential to make $500k-1m/year before 30. The odds of getting to that stage aren't high, because of the culling at each step, but are probably better than making comparable money through a start-up exit.

2) Substantive responsibility. It depends on what precisely you do, but my brother is a year in and has a ton of autonomy and responsibility in his particular area. You can get this in Silicon Valley, but most of corporate America will not let a 24 year old do anything important.

3) Exit options and signaling. If you want to be a venture capitalist, the highest-probability route is through an NYC bulge-bracket bank. A stint at Goldman/Morgan Stanley/etc almost guarantees admission to a top business school, and from there a wide range of careers in corporate finance/development.

The only salient aspect of the article is the bit about risk: it is true that the folks on Wall Street generally aren't risk takers. They often make big bets, but with other peoples' money, and in any case if they are not successful there's a soft landing for them at Harvard or Wharton.

</comment><comment><USER8> >The banks care less about their qualifications than their work ethic. Being a Rhodes Scholar doesn't make much of a difference when you're a young banker. More of it is being willing to stay at the office for 120 hours a week.

This is very, very true. In my experience, investment banking is by no means a particularly difficult thing to do, given enough capital to play around with. Quants aside, the concepts that are used (take, for example, "mezzanine capital") are mostly buzzwords used to give a professional air to really very simple processes/ideas. It is a far cry from the serious, dedicated abstract thought demanded by fields such as software engineering/machine learning/data science etc.

However, what large financial institutions need are people who are extremely assiduous to small details, have a work ethic in which 7am-11pm hours creating powerpoints are no big deal (and have good sounding qualifications to impress investors).

<comment><USER9> How necessary are the 7am-11pm hours really? Could the banks do just as good of a job if they hired more people who worked 40 hour weeks? (Increased salary costs notwithstanding)

<comment><AUTHOR> I work at a law firm specializing in IPO. I had the same thought in mind when I joined.

Hiring more people does help but there will still not be 40 hour work weeks. In many instances, some people in the team has built up the knowledge on a particular part of the deal that it is difficult to outsource since it would be much faster for the person to complete the work themselves.

Hiring more people also means that the information is diffused around. If one person working on a deal it means that he knows 100% about the deal. If 100 people is working on the same deal, efficiency would greatly decrease as knowledge management becomes important (lots of emails).

<comment><USER9> Thanks for the info! Is the demand for detailed knowledge 16 hours at a time, or is it more like being "on call" for when a client suddenly gets a wild idea and wants numbers to be run for it?

<comment><USER10> From interviews by folks on Wallstreetoasis.com, this is my understanding of the hours. Some days they may have 2-4 hour breaks (gym time / internet time), then have to crunch in the evening when a client, or an internal-facing client (such as a Managing Partner) comes back.

In my short time at a small consulting firm (Management / C level), this was also the case.

Many times my long hours were due to "deliverables" (PowerPoints, documents, etc.) being in a choke point based on an Analyst, Consultant, etc.

E.g., waiting on numbers to finish a presentation.

However, much of the time, their is ALWAYS something to do, and much of it is very much face-time (butts in seats = working).

</comment></comment></comment></comment></comment><comment><USER11> Goldman Sachs 2011 net income was $162,913 per employee. Average pay was $367,057. It's harder to get data on Google, but it looks like the mid-career median salary is $141,000. Google's Gross Profit (Total Revenue less Cost of Revenue) was $24.7B in 2011, and GS's was $24.5B. At the same time, Google had 32,467 employees to GS's 35,700. Yet, the Google net income was $9.7B compared to $4.4B on the GS side. The difference seems to be made up entirely by the difference in employee compensation.

It's the money, stupid.

<comment><USER12> Google's success doesn't and won't carry America's economy. And most of google's top paid employees are programmers.

It's the success of companies that design/make things that will carry America's economy. And these companies are losing their top prospects to Wall Street. Not a good trend.

</comment></comment><comment><USER13> Anyone have thoughts on this gem?

> I talked to one guy who's a former Goldman Sachs guy who left to go to the > tech industry who said the adage in the tech world now is "be wary when the > pretty people show up."

<comment><USER14> Arguably, the "pretty people" have been here for a few years now. But don't take my word for it: [http://www.modernluxury.com/san-francisco/story/go-west- youn...](http://www.modernluxury.com/san-francisco/story/go-west-young-bank- bro)

<comment><USER13> Also, since when are bankers pretty anyway?

<comment><USER15> Well groomed and well dressed, perhaps.

</comment></comment></comment></comment><comment><USER16> The portrait of the college grad painted in the article is consistent with what I've seen as an undergrad at Harvard in econ and CS circles.

> [College students want money, structure, and sex appeal.]

But I'll add another motivation to the laundry list, that draws smart grads to selective/prestigious programs (including Harvard, Goldman, Google, and even YC): Smart grads want to be surrounded by other smart grads, because they want to build peer relationships with future co-founders and business partners.

<comment><USER5> Yes most of the graduates from the top 10 universities and probably 100% of the ones who go for IB are not insecure.

The only ones are the 1% for come from poor backgrounds and managed to get a place on merit and who haven't learnt to fake it and are conflicted about changing social class

</comment></comment><comment><USER17> Pet peeve: 120 hours a week is 17 hours a day, leaving 7 hours for sleep assuming literally nothing else is done. While those kind of numbers are often used to sum up the lifestyle of "wake up at 6, get to work at 7, get breakfast, lunch, dinner, drinks with work, get home at 10, go to sleep, repeat," even that ridiculous schedule puts you at 15 hours a day, or 105 hours a week, assuming you treat weekends the same as weekdays. To hit 120 hours a week, you'd have to be arriving at work at 5 and leaving at 10 every day (or 7 and 12, etc.), and that counts all meals and breaks as work hours. No one I've ever met works that many hours (and I went to college with a lot of bankers). There may be the occasional day like that, or the odd week where you push 120 hours (but primarily based on one or two all nighters), but no one regularly spends 71% of their total week working, unless you count any non-leisure as work. It's simply not possible.

</comment><comment><USER12> Wall Street is NOT building up America but is instead weakening America by causing a Great Brain Drain from every other vital industry. It is a cancer that's eating away America. Because America is losing the brightest kids who could've really shined and played vital leadership roles in other industries, I feel American industries are falling behind.

Some quotes from the article that you should remember:

1\. "so many kids who could seemingly do anything choose to work 120-hour weeks"

2\. "something like a third of Ivy League graduates going to Wall Street"

3\. "They're not just getting finance-minded kids but they're getting the smartest kids from all fields."

4\. "give us two years of your lives, don't see your friends, chain yourself to your desk, but we will give you this glorious life where you're making many times what you could ever imagine."

These are kids really really smart, socially adjusted (enough to be accepted by Ivy League), and hard working. If they entered science/medicine/engineering/etc, they would've added great positive impact. Probably not immediately but eventually years down the line. And now they are abandoning these vital industries that actually produce something for an industry that is basically pushing papers around and printing money in the process.

Seriously, WHY would anyone choose to enter a field where you have to work up the ladder (or spend years in grad school and in poverty life) and possibly live in some small towns with a hope of making a few million a year salary ONLY near the end of your career, when you can enter Wall Street and live in NYC (great city but really only for the super rich) and start making 6-7 figure salary/bonus almost from the beginning?

Other major economies do not have Wall Street equivalent and so their top engineering/science graduates don't join finance but instead actually enter the vital industries. And these smart kids actually produce something that is tangible. I think we are already seeing the effect of this trend showing its result slowly.

I know we live in free economy society and all that but I think we need to find a way to 'regulate' how the wall street recruits.

Lastly, I believe the ratio of liberal-arts majors entering Wall Street is way lower than the article seems to suggest. From what I hear, overwhleming majority of the graduates entering Wall Street after graduation are science/math/engineering majors.

<comment><USER7> Ivy-league grads go into finance because it's an industry that really values their particular pedigree, and is willing to pay for it. Engineering, on the other hand, really doesn't. Engineering companies aren't paying $200k bonuses to kids just a few years out of an Ivy-league school. Indeed, it's pretty hard to set yourself apart, as an engineer, in a way that allows you to earn even twice as much as another engineer of a comparable level of experience.

Thus, the complaint that Ivy-league grads flock to banks is confused. If the banks are correct that Ivy-league grads are the best and the brightest, to the point where it's justifiable to almost not recruit at all outside a small set of "target schools," then the young kids are quite justified in going into an industry that appreciates their qualifications in a way science and engineering don't. On the other hand, if the banks are wrong about ivy-league grads being so much better than everyone else, then nothing much is lost that they go into banking!

<comment><USER18> > If the banks are correct that Ivy-league grads are the best and the > brightest,

They aren't. Ivy League grads have "high-status branding" that the banks use to get faux credibility when signing big deals.

<comment><USER7> In that case, why lament they're going to finance instead of stem?

</comment></comment></comment></comment><comment><USER19> There was an article maybe a decade ago in the _Economist_ (I've never been able to find it since) claiming that being the hot industry for new Harvard Business School grads to join was, based on past performance, a solid countercyclical indicator: the MBAs started to join just as the industry had already peaked and trouble was on the horizon. IIRC it ended by observing that now (ie. then) they had started to go to Wall Street. I don't know if that's still true, or was actually ever true, let alone if anything similar is true of Harvard first-degree holders, but I thought I'd leave it here. ;)

</comment><comment><USER17> Last comment: I majored in PoliSci. If I went back and did it all again, I'd recommend consulting (good pay, exposure to a lot of verticals). Banking would be tempting purely for the pay. I may not have worked banking hours, but I didn't come near a banking paycheck (my hours divided by stereotypical banking hours > my salary divided by a standard banking salary). Wall Street pays better than anywhere else for the background of their recruits, and the difference is so stark that unless you are a big firm consultant, the economically smart decision is banking.

That said, I'm happy where I am now, working on growth and customer acquisition at a really cool YC company, where I actually want to work all the time. I wouldn't be here had I chased banking dollars.

</comment><comment><USER20> This title is missing an important part of the actual title: "How Wall Street recruits so many _insecure_ Ivy League grads".

<comment><USER21> Interestingly, the post originally had that word in the title. Moderators what?

</comment></comment><comment><USER22> I'm genuinely curious -- what do these recruits actually do while working these massive hours? Is there really 80-120 hours of desk-based work to be done, or does office politics or fraternizing play a role in those hourly figures?

<comment><USER23> I've worked for banks to 15 years or so, but always on the sales and trading side, rather than the investment banking side. In general, I like the industry. However, I've come to believe that the 90 hour analyst work week is hazing, pure and simple. It doesn't really matter what they're doing. Being a banker is a pretty plum job and it simply weeds out people who don't really want the job that badly. The other aspect is to gauge your personality & fit under adverse conditions, though the adverse conditions are artificial and arbitrary.

On trading desk the analyst/junior guys typically will work like 6:30 through 7:30, which is not that much more than anyone else. They will be required to get lunches, coffee and other assorted errands. Again, this too is a form of hazing.

<comment><USER24> My friends in finance definitely make it sound like hazing to me, just like you said. I have a friend whose boss had to talk to him about going too easy on the new analyst, so he had to toughen up and make the analyst's life harder just because.

</comment></comment></comment><comment><USER25> Investment banking gets a pretty bad reputation in the media, and there are many misconceptions about the industry. I don't think this article was terrible, but I do disagree with a few of the points. For the record, I'm an undergraduate student at a non-Ivy but huge feeder into investment banks.

> They're going because they hate risk and are terrified about what to do next > and Wall Street has figured out a way to calm their anxieties.

This is somewhat accurate, but it doesn't seem different from other careers. Not all of friends know exactly what they want to do when they graduate. So it's logical for them to pick a job that is well-paying, will continue to exist for at least a few years, and offers good exit opportunities. For this reason, most of my intelligent friends in computer science are looking to work at Google, Amazon, Facebook, etc. Similarly, most of my intelligent friends in finance are looking to work at premier investment banks (or premier consulting firms like McKinsey, Bain, BCG, etc.).

> So they created the two-and-out program. The idea is you're there for two > years and then you move onto something else. That let them attract not just > hardcore econ majors but people majoring in other subjects who had a passing > interest in finance and didn't know what else to do.

This is absolutely correct; it's well known that you'll stay for 2 years and then move on to another finance world (Private Equity, Hedge Fund, Venture Capital) or perhaps business school. But the way the article describes this feature makes it sound as an evil trick. Maybe I'm the only one who gets that vibe, but I think this is a great feature for students who aren't yet ready to commit to a career (again, not exclusive to finance).

> And it's amazing, anecdotally, how often you see college seniors deciding > between making huge money on Wall Street or making almost nothing with Teach > For America.

I had a conversation with a TFA rep a few months ago, and he told me that my school was the largest feeder into TFA. Yet, I have never met someone deciding between investment banking and Teach for America -- obviously two very different career options. The TFA rep also said the major with most students applying to TFA was Accounting, which makes sense because the entry job for an accounting student is not as high-paying or "exciting" as the entry investment banking job.

> Being a young banker seems like an incredibly miserable existence. The > people you follow are beyond unhappy.

Yes, some of my friends who did investment banking internships (it's near impossible to get the full-time offer without an internship) ended up being miserable. However, some enjoyed the internship very much, and they return for full-time. Again, this isn't unique to banking. I'm had an engineering internship at a top tech firm, and I haven't enjoyed it as much as I expected either. Nevertheless, some of my friends in similar roles at other tech firms are probably enjoying their experience.

> I talked to one guy who's a former Goldman Sachs guy who left to go to the > tech industry who said the adage in the tech world now is "be wary when the > pretty people show up."

This is not common. I'm majoring in Finance and EE, so I'm one of the few people who would potentially be making this decision. If we're talking about choosing between banking at Goldman Sachs and working on the acquisitions team at Google, then sure, that's a legitimate argument. But the only time students are making the decision between being a software developer at a tech firm and being an investment banker is when they apply for college and decide on their major.

Overall, I didn't think the article was horrible, but there were a few things I wanted to clarify. And although I don't plan on working for an investment bank, I hate to see the career ridiculed by misconceptions. I saw in another comment that it doesn't really take intelligence to work at an investment bank or it's not really difficult to do. Please don't insult a career if you've never really experienced it. Some bankers may not be very smart, but others are ridiculously intelligent and great at their job.

<comment><USER18> TfA is pretty much a gimmick to pad resumes of business/law school applicants. Schools do not enjoy the TfA newbie teachers coming in, acting like they are saving the shool, and then disappearing after a couple of years.

TfA it serves a similar purpose as these 2-year finance jobs: resume padding for the next hop. TfA just has less salary.

<comment><USER3> I went to an Ivy League school that served as a large feeder for Teach for America. At least one year, Teach For America was the single largest employer of graduating seniors.

Unlike GP, I would say that at my school, TFA and I-banking attracted students with similar credentials, at least on paper (same majors - economics, poli sci, histories, etc.). I can't speak to their motiviations or if any students were considering both, but I _will_ point out that TFA uses the same recruiting timetable as the investment banks and consulting firms, as well as many of the same recruiting strategies, so TFA does appear to view themselves as competing for the same pool of applicants to some degree.

I agree that TFA largely serves as a resume pad - some people do TFA because they want to teach in the long run, but many (I think the majority) view it as a "stepping stone" to law school or business school, and TFA certainly doesn't make any attempts to quell that belief with their recruiting.

TFA also has questionable results - here is one op-ed written by a former TFA fellow who explains some of the problems with the program[0].

Teach for America receives a lot of money from political groups and individuals who oppose unions, because (for better or for worse), they essentially undermine teacher unions in their districts and reduce their power.

Teach for America certainly started off with very nobles goals - they may still have the same goals today, but whether the actual net impact they are making is a positive one is less clear, and is a very political question.

[0] [http://www.policymic.com/articles/62487/this-former-tfa- corp...](http://www.policymic.com/articles/62487/this-former-tfa-corps-member- thinks-you-should-join-city-year-instead)

</comment></comment></comment><comment><USER17> The people who stick around Wall Street are the people who fit the stereotype. The others are people like my brother, who went to Stanford, wanted to learn something, and had a passing interest in finance. They paid him well enough to set him up to be able to take a pay cut (on a total comp basis, not hourly) for a better lifestyle, and gave him a ton of really valuable training. After 2 years, he moved on to private wealth management, and loves it. He may not be a stereotypical example, but he didn't go to Wall Street in a risk averse move. He went because it let him learn while being paid well.

</comment><comment><USER26> > They're going because they hate risk and are terrified about what to do next > and Wall Street has figured out a way to calm their anxieties.

Isn't it a bit far-stretched. It's clear to me they're going because it's by far the most lucrative path. It's not surprising that 1/3 of ivy grads are looking to make as much money as they can.

> Being a young banker seems like an incredibly miserable existence.

When I graduated, many of my school mates went to work in the financial industry (not investment banking though) and they didn't look miserable to me. Retrospectively, it looks it was a good career choice.

This article sounds biased. It'd be interesting to have a more objective account about this type of jobs.

</comment><comment><USER27> A related Quora answer I wrote a while ago:

[http://www.quora.com/Investment-Banking/Why-are-there-so- man...](http://www.quora.com/Investment-Banking/Why-are-there-so-many-short- careers-in-investment-banking/answer/Jon-Cooper-2)

</comment><comment><USER17> >> A lot of kids graduated with a degree in sociology or English literature and feel they don't know any skills that will help them get a job.

PoliSci major here. You don't have any skills you learned in school that can help you get a job. However, if you went to a good school, you should at least be able to demonstrate that you can learn fast, which is one of the more useful skills out there. A lot of jobs require skills that simply aren't taught in school, so being self motivated and a quick study can be more valuable than anything.

</comment><comment><USER28> _I talked to one guy who 's a former Goldman Sachs guy who left to go to the tech industry who said the adage in the tech world now is "be wary when the pretty people show up."_

</comment><comment><USER17> Also, working for TFA in the Mississippi Delta after living in LA, NYC, or SF, you can easily save a ton of money simply because staples and housing cost so much less (my roommate at UCLA did Mississippi Delta, and while he probably could have made more somewhere else, his savings after 2 years were pretty impressive - although that may have been a skill unique to him).

</comment><comment><USER17> The HN title of this leaves out a key adjective: How Wall Street recruits so many insecure Ivy League grads.

Insecure is an important one, without it, I clicked thinking that the "how" should be obvious, and the the right question is "why."

</comment><comment><USER29> People always talk about the money, but specifics are tough to come by. What is the typical salary for a first-year I-banker? How about the median for the ones who make it to year five and year ten?

</comment><comment><USER30> why do these junior bankers do that require 120hr a week of work?

What kind of salery do they get after 1 - 10 yeard of working

</comment><comment><USER31> Uh...one character: $

</comment><comment><USER32> This guy has a fairly good understanding of entry-level finance culture but no clue about the Valley.

 _You get the sex appeal and allure of the tech industry_

Lolwut. Sex appeal? Maybe _Mad Men_ 's Michael Ginsburg was on to something.

 _Now it 's people who are well adjusted, good looking graduates of elite institutions. It's gone from weirdos in pocket protectors to the guys who used to go to Wall Street._

Carpet-baggers. And they aren't any better (or worse) looking. Same with bankers. On average, they're average looking. What they are is more assertive, while engineers tend to be meek doormats. True-blue engineers don't get driven out because business people are better looking, but because they're more assertive. Blaming it on "pretty people" is refusing to take responsibility. Gates, Jobs, Bezos, and Ellison are average-looking at best.

Ok kids, so here's what the analyst program is really about. When you're in school, deadlines are easy to meet and well-tested. If you miss a deadline that 20 of your peers made easily, then either something bad happened or you fucked up. People coming out of school tend to have a "deadlines is deadlines" mentality, because they've spent 16 years in a world where almost all deadlines were well-tested and could be met by anyone with a work ethic (and a stable home, and no health problems, but we're sampling from the upper-middle class here). The difference, in business, is that many deadlines are untested and arbitrary. Some deadlines you absolutely have to meet. Most are just some guy's opinion, and as long as you aren't personally responsible for the miss, it doesn't matter.

Soft-side finance and biglaw have larger-than-normal proportions of deadlines that actually matter and want to put people through a wringer to see who has the unconditional (again, "deadlines is deadlines") work ethic and who doesn't. In some businesses that are heavily relationship-based, having at least one person on the team with an unconditional work ethic can be a lifesaver.

It's bad for tech that it answers to such people, though, because the sorts of people who tend to have an _unconditional_ work ethic are a disaster in any line of business that requires vision. It's the tradeoff between subordinacy, strategy, and dedication (pick two). People who are subordinate and dedicated (unconditional work ethic) will never be strategic, which means they'll be poor at choosing what to work on. They're great in analyst positions and maybe as VC-funded founders (because the VCs are the true executives) but absolutely useless in decision-making roles.

</comment><comment><USER33> > In previous lives, I've worked as a tennis-camp counselor, a juice bar > barista, and a Biblical slave for a bestselling author. (Long story.) I've > also written for magazines like GQ, Esquire, ESPN: The Magazine, and SPIN. I > live in Berkeley, California.

Interesting the author has no finance experience ever, which makes me question his motives.

<comment><USER34> So, he's a journalist? Isn't that what journalists do?</comment></comment>


Mozilla Outlines Plan to Replace Firefox for Android with 'Fenix' - <AUTHOR> https://www.androidpolice.com/2019/04/26/mozilla-outlines-plan-to-replace-firefox-for-android-with-fenix/ <comment><USER2> Seems quite good, but still a few rough edges (only nightly builds with no auto-update, Lastpass doesn't seem to work with it, you don't get that "open in app" icon. Doesn't seem to be any way to install add-ons, yet it seems to be using my adblocker from standard Firefox)</comment>


Italy Locks Down Much of the Country's North over the Coronavirus - <AUTHOR> https://www.nytimes.com/2020/03/07/world/europe/coronavirus-italy.html <comment><USER2> [https://news.ycombinator.com/item?id=22516450](https://news.ycombinator.com/item?id=22516450) I've posted here about the Chinese/South Korean system of a "foursquare" type system for coronavirus seems to be helping contain the spread. How realistic would it be for HN to build something like this? It appears like it would make a big difference.

Here's the reddit thread where I sourced it from and relevant information (poster has been verified as being in China)

[https://www.reddit.com/r/China_Flu/comments/febv3t/what_its_...](https://www.reddit.com/r/China_Flu/comments/febv3t/what_its_like_in_china_0306/)

Public areas would take your name and phone number before allowing you to enter, in the event someone there later was determined positive, they could contact you and find you quickly. This moved digitally in QR code based systems, were you would scan various locations, buses, taxis, subways, etc. and be able to be contacted and located quickly.

<comment><USER3> > Public areas would take your name and phone number before allowing you to > enter

Then that wouldn't really be a public area, would it?

Many people, especially older ones who may use feature phones, don't have devices which handle QR codes.

Ditto for children, who may be allowed to go to public areas on their own, but don't have a QR-enabled phone.

A few years ago I left my phone in the taxi on the way to the airport. I didn't have a phone for a couple of weeks. Or, what if your phone or battery died while you were out?

Some people don't like the tracking already done and available. This takes it to the next level by making location tracking mandatory.

What benefit is there to participate? Wouldn't the majority of those people prefer to enable location tracking on their phone instead of manual QR checks?

<comment><USER2> All I'm saying is I hope it would help. All your views are valid but all I can think of is this can save lives.

<comment><USER3> It could make lives worse too.

Suppose there are multiple such systems, each with different sets of users. Someone's infected while at a train station, and only 25% of the people are contacted. Should those who are not contacted feel safe? Or extra worried, compared to how they would have reacted for having no such system?

As I wrote: "What benefit is there to participate? Wouldn't the majority of those people prefer to enable location tracking on their phone instead of manual QR checks? "

If most would prefer automatic GPS tracking over manual QR checks, the what you're proposing would result in multiple systems and incomplete coverage both for users and for people who would set up the QR codes.

</comment></comment></comment></comment><comment><USER4> I'm from Milan and it's totally surreal to read of these places I know so well being shut down and paralysed.</comment>


Form-Finding and Structural Optimization: Gaudi Workshop - <AUTHOR> http://ocw.mit.edu/OcwWeb/Architecture/4-491Fall-2004/CourseHome/index.htm

<comment><AUTHOR> Some interesting URLs I've just found:

Gaudi's method for designing the _Sagrada Familia_ cathedral [http://www.math.upenn.edu/~ted/114F08/ExtraCredit/Problem3.p...](http://www.math.upenn.edu/~ted/114F08/ExtraCredit/Problem3.pdf)

A different kind of string theory: Antoni Gaudi <http://memetician.livejournal.com/201202.html></comment>


Ask HN: How much equity should I ask for? - <AUTHOR>

I've been invited to join a startup as it's first employee and I was asked to think of the compensation package that I would like to receive, which includes equity.<p>What is a fair amount of equity to ask for? <comment><USER2> What's your role gonna be? Will you have a Founder title? That will completely inform the answer. Joining as a co-founder or President? Go big, 5-10%. An exec? Aim for 3-8%. An Engineer or other role? 1-3%.

And of course, always ask for more than the above at the outset. It's a negotiation.

<comment><AUTHOR> I won't be joining as a co-founder, and the role i'm gonna play in the company is more on the engineering / product side.

So i'm guessing somewhere around the 5% region would be fair?

<comment><USER2> You would be blessed to get 5%! Standard from what I see in early stage startups in Silicon Valley... I'd shoot for 1%, and be happy with 0.5%. Dirty secret of the Valley: You only get rich if you are a co-founder, or join the next Google.

<comment><AUTHOR> Ah, pardon my naivety. Well, I'll look at the figures you provided then. Thanks!

</comment></comment></comment></comment><comment><USER3> Are you taking a reduced salary? How much would they give you if you had invested that amount in cash instead?

<comment><AUTHOR> Well no, I won't be taking a reduced salary for they're willing to pay (close to) market rates.</comment></comment>


SoftBank's Billions Spur Global Race to Pour Money into Startups - <AUTHOR> https://www.wsj.com/articles/softbanks-billions-spur-global-race-to-pour-money-into-startups-1523790001 <comment><USER2> Masayashi Son and Softbank have the history of _greatest lost of net worth ever_ :

[https://www.bloomberg.com/news/articles/2017-10-11/how- softb...](https://www.bloomberg.com/news/articles/2017-10-11/how-softbank-s- son-bounced-back-after-the-dot-com-crash)

So, I wonder if everyone who is following Softbank's lead will have the iron stomach to take those kind of losses, if market crashes.

<comment><USER3> With big loss of money, come big gain of knowledge. \- Some Saudi

</comment></comment><comment><USER4> Didn't the paradise papers basically reveal that softbank is the acceptable face of dodgy money?

<comment><USER5> Only thing I could find about Softbank and paradise papers is a few lines in a NHK world article [1]:

> Telecom giant Softbank Group set up a business entity based in the Cayman > Islands to operate an investment fund four years ago. The name of the > company's CEO, Masayoshi Son, was mentioned in one of the documents.

> Softbank says it registered the investment fund there to avoid dual taxation > for its investors.

While suspicious, this seems like too little evidence to support a broad statement such as "softbank is the acceptable face of dodgy money".

[1][https://www3.nhk.or.jp/nhkworld/nhknewsline/backstories/bign...](https://www3.nhk.or.jp/nhkworld/nhknewsline/backstories/bignamesinparadisepapers/)</comment></comment>


Nissan got a sweetheart deal. Under hard Brexit, everyone will want one - <AUTHOR> https://www.theguardian.com/commentisfree/2016/oct/28/nissan-deal-hard-brexit-britain-trade-europe <comment><USER2> The Guardian seems shocked, shocked to discover there are deals being done to keep business in the UK.

<comment><USER3> Or suggesting that such deals, replicated across the economy, will end up being costly for the UK.

</comment></comment><comment><USER4> This seems to be open speculation: "No one knows, yet".</comment>


Mozilla Presses Pause on Facebook Advertising - <AUTHOR> https://blog.mozilla.org/blog/2018/03/21/mozilla-presses-pause-facebook-advertising/ <comment><USER3> One of the first things you see on that page (on mobile), even above the headline of the article, is a Facebook share button.

Facebook has its claws in deep. De-Facebooking the Web isn't going to be a simple task.

Bit of hypocrisy to say 'we're not advertising on Facebook anymore' while leaving those buttons in place. Would be ironic if people shared this article on Facebook.

<comment><USER4> Is there a way to put a "Follow us on Facebook" button without a FB tracker script?

<comment><USER5> Follow](http://facebook.com/yourpagename">Follow) us on Facebook!

<comment><USER6> Gold. :-)

Should probably be [https://](https://) though!

<comment><USER5> Why bother? They're gonna just share your info with everyone anyway ;)

</comment></comment></comment></comment></comment><comment><USER7> But wasn't it obvious to everyone who glanced at the Facebook API back in 2014 that it was trivial to gather tons of information, and all they asked you to do was to clickwrap promise that you'll be a good boy/girl?

<comment><USER8> Yes, exactly. Really shocked, shocked to learn that there was some web scraping going on..

<comment><USER9> In light of articles like [https://ijr.com/2018/03/1077083-ex-obama-campaign- director-f...](https://ijr.com/2018/03/1077083-ex-obama-campaign-director-fb/) the quote is even more appropriate.

</comment></comment></comment><comment><USER10> I find the danger with ad blockers is they hide the true extent of the tracking from me, because I never see the results.

I've now sandboxed Facebook (and others) in container tabs in Firefox so no cookies go in or out, along with uBlock Origin to whitelist JS per site.

<comment><USER11> Can you elaborate how you sandboxed tabs in Firefox? I use incognito when using Google or sites that use Facebook commenting on order to lower the tracking ability, but sandboxing sounds better.

<comment><USER10> I make one "Container" per account, and then visit the page in question and tick "Always open in $CONTAINER_NAME. Then when you sign into Facebook, any other domain won't get the cookie.

Then get Cookie AutoDelete, tick "Enable Support for Firefox's Container Tabs", and whitelist the cookies you need to sign into those sites.

Combined with uBlock Origin it's the best setup I've found so far, though Firefox Quantum destroys my MacBook's battery.

I used to have Safari and Safari Technology Preview to keep good battery life, with only one browser signed into Google, FB and others but I still noticed some searches into the non-signed in browser leaking to FB - I have a feeling the two browsers share some state.

If anybody knows an improvement for Firefox's battery usage on macOS I'd love to hear!

</comment></comment></comment><comment><USER12> Didn't Mozilla side load a Mr Robots extension ad and silently install Cliqz adware onto German users? IIRC the Cliqz extension sends all your browsing history to them.

<comment><USER13> Yes, they did, and it caused Mozilla to lose almost a quarter of their German marketshare in a few months.

The CliqZ debacle was insanity, considering that Burda, the parent company of CliqZ, is mostly known for its ad and tracking networks, and its clickbait tabloids.

</comment></comment><comment><USER14> With advertisers pulling out, this is officially turning into a shitstorm. But it's surprisingly frustrating watching everyone slowly catch on to what I had already figured out 8 years ago about the nature of Facebook. Even more so when I think about all the people who'll just go right back when the outrage dies down.

<comment><USER15> It's really not turning into a shitstorm. People are comforting themselves by telling themselves that.

Here's what is going to happen.

\- Facebook's finances won't be meaningfully impacted at all. Advertisers are not going to abandon FB in any consequential numbers. They'll spit off ~$21 billion in net income in 2018 and end the year with around $50 billion in cash. One of the richest corporations in world history, at the age of 15. Comparable to the income production of Microsoft, a juggernaut that is 40 years old.

\- Zuckerberg and Facebook will go to Washington, so to speak. They'll bow down as the powers want them to, pledge changes, blah blah blah. We're so very sorry we helped Donald Trump to get elected, we promise it won't happen again.

\- Some new monster US Government bureaucracy will be crafted. It'll simultaneously be claimed to protect privacy while assisting the government in further abusing it. The Digital Protection Agency. It will also make compliance increasingly costly and difficult, benefiting the existing tech giants, entrenching their positions against start-up competition. This will increase stagnation. [1]

\- A very tiny, entirely meaningless, portion of Facebook users will quit. It will be 1% or less. Most people don't care. Even the ones that do, will overwhelmingly continue using the platform to broadcast their opinions or photos or just to communicate with friends & family generally.

\- Political speech and political advertising will be further restricted online. The big tech platforms will become regulated stand-in government & political party censorship systems, as with traditional broadcast media of past generations. This is aggressively being put into place now, across every major social network. They're all going to comply willingly.

\- Political power, and the power of these tech giants, will be more entrenched than ever before. It will become even harder to unseat those already in power. The duopoly politcal party system in the US, will ensure its survival at the top of the food chain and will regulate the platforms to their benefit, as was the case with traditional media. Again, this is taking place right now. Nothing will prevent it.

As the tech giants increasingly pledge fealty - while on their knees begging forgiveness - to the existing political system in DC - the two parties - <USER2> survival will be guaranteed and protected through regulation and favors. This is tradition at this point, going back nearly a century. The powers that be in Washington don't care who wins in tech, or how much money the winners make, they care about obedience to their agenda of maintaing control & power.

[1] [https://www.bloomberg.com/news/articles/2018-03-21/paul- ford...](https://www.bloomberg.com/news/articles/2018-03-21/paul-ford- facebook-is-why-we-need-a-digital-protection-agency)

<comment><USER9> > It will be 1% or less.

1% is like 10 million. More like 0.001% or less. I know many non-tech people using FB. I don't know any of them who considered quitting FB because of such concerns and it's unlikely they would. I mean, they can feel concerned or even outraged about FB shenanigans - just like when they hear yet another politician has been caught stealing millions or harassing employees or selling his vote to the highest bidder - but they don't move to another country because of that.

Otherwise, your bleak picture seems to be entirely correct.

</comment></comment></comment><comment><USER16> Initiatives like this is what really makes the big tech giants change. Google and Facebook sees you as the product, when you switch services it's not really the end of the world. Keeping you on their platform is a cost.

To cover this cost and profit off of you, they need advertising dollars. Those entities are the real customers and Facebook and Google _must_ keep them on. And this relationship is one of the reasons I think Google and Facebook are overvalued because Wall Street doesn't see the parallel with other industries and how their brand has suffered from lack oversight.

When H&M was found to be using child labor in Pakistan we didn't allow them to get away with excuses about "oh, we produce so much clothes, we can't just switch" they had to promptly tell us what their exit strategy was from that textile provider. Imagine Wells Fargo is found to have bought adds from Google that was featured on an site for Holocaust denial or ISIS recruitment, really bad stuff. Imagine the reporter asking if Wells Fargo supports ISIS and they would answer "of course not, we have no idea where Google will feature our ads, we only know what target demographic we bought" to which the reporter could reply "so, will you make Google guarantee you won't be funding Islamic extremism? Or will you be moving off of Google soon and start buying ads from local newspapers where you know for a fact they won't publish ISIS recruitment or Holocaust denial pieces?".

When it starts sinking in for the Fortune 500s what they're really buying Google and Facebook will find that quality control is a lot more important and expensive than they previously thought.

</comment><comment><USER17> Not sure how many of you run pihole and check the logs. The number of sites tracking people is crazy. To top it, devices and android phones in particular, seem to be doing it a little too much as well. I tried using mi phones for a while and decided to stop after looking at my logs.

<comment><USER18> This is why I always buy phones that allow me to flash my own ROM.

That way you only have Google (and whatever apps you decide to give access to) tracking you and not your OEM.

</comment></comment><comment><USER10> Is this purely a symbolic move?

Do you think other people will follow or is this a statement of position?

<comment><USER19> I see a lot of Mozilla ads on Facebook, for what it's worth. Enough that I'd assume this is a somewhat significant move for them.

<comment><USER20> What kinds of ads do Mozilla have ? Ḯ'm a bit surprised that they advertise at all.

<comment><USER19> Mostly they focus on their privacy initiatives and features. Not just Firefox directly, but other projects to build brand affinity or something.

I'm afraid I can't go check what ads I saw, since I just jumped on the bandwagon and deactivated my account.

<comment><USER20> Before you deactivate, set a unique password so it doesn't get hacked. One day I got asked if I had re-joined Facebook supposedly I was making posts about food supplements ...

<comment><USER19> Prudent advice. Thankfully, I already had, and it's nicely locked up in 1Password. :)

</comment></comment></comment></comment></comment></comment><comment><USER21> I always wondered why Facebook did not buy Opera.

<comment> Method-X And thank god they didn't.

<comment><USER21> Yes.

</comment></comment></comment><comment><USER22> Would it be possible to have "parental ratings" on ads for adults? The problem with advertising is once you've seen it, there is few methods to unsee it (you could probably argue some hypnotherapy can do).

By forcing someone to see an ad without a prior approval of the viewer, it's also forcing someone to passively memorize some sort of information. And in some maybe not-too-distance-altered-carbon future, violate their right to forget the ad (as there is no such method you can pay for forget seeing an ad).

What if instead of having a button on an ad to say "Do not show me ad like this", instead having all ads start with a button/muted dialog such as "We like to show an ad of this sort, and it will likely create light memorization, strong persuasion with heavy text but little colorful graphics".

I'm really thinking the events going on right now can create some new opportunity to reimagine how the relationship between ads and viewers could work out.

<comment><USER10> If this did happen Facebook would quickly figure out exactly what ads you like/make an impression on you, which is just more ammunition for adtech.

</comment></comment><comment><USER23> Mozilla is funded by Google, who desperately wants to dethrone fb. So it's not surprising.

<comment><USER24> Is that still true? I thought Google stopped funding Mozilla recently.

Edit: Just checked, they had a deal with Google until 2014 when they signed with yahoo instead. As of 2017 they switched back to Google as the fault search engine but there's no info on Wikipedia at least about whether or not they get money this time around

<comment><USER23> Of course they get money. Otherwise why would they set google as default.

<comment><USER25> Absolutely. You can see Mozilla attribution in the Google URLs. (Unless you've modified your search engines--which Mozilla has made harder to modify.)

<comment><USER23> They have indeed made it a lot harder to modify. And even harder to set it to Bing! Earlier it was just a dropdown in settings.

<comment><USER24> Uh, i thought it was easier? All the options for search engines are in the results in quantum</comment></comment></comment></comment></comment></comment>


Why This Is Unlike the Great Depression - <AUTHOR> https://www.lynalden.com/great-depression/ <comment><USER2> 1\. Inflation rather than deflation.

The situation is more like the one in the 1940's. Back then, the Fed pegged the entire yield curve and bought enough treasuries of all durations to effectively shut down the free market.

The idea was to support the war effort through monetary policy. Today, there's another kind of war, but policy makers will use the same economic response.

The federal debt rose to just over 100% of GDP during WWII, but inflation in later decades took care of the problem. Translation: those who bought treasuries during that time paid the price later.

2\. Debtor nation vs. creditor nation.

The US entered the Great Depression as a creditor nation. It enters this crisis as a debtor.

Most holders of treasuries are outside the country. Pegging the yield curve causes the dollar to fall and so they sell, putting further pressure on the Fed to keep the liquidity flowing by buying treasuries.

The upshot: nominal returns may do just fine. The stock market can make new highs without a problem. However, real returns will be hit hard. Look to foreign assets, gold, and silver as hedges.

But.. I can't help thinking about this:

> In 1933, United States put forth an executive order saying that all citizens > must turn in their gold for payment at the prevailing rate, other than > jewelry, and they made it illegal to own gold in bulk for the next few > decades.

It's not inconceivable that something similar capital controls could be tried this time around.

</comment><comment><USER3> Millionaires and billionaires to avoid $82bn in tax liabilities.

[https://www.theguardian.com/world/2020/apr/15/tax-change- cor...](https://www.theguardian.com/world/2020/apr/15/tax-change-coronavirus- stimulus-act-millionaires-billionaires)

I think this is only the beginning. The quadrillion-dollar question is how much hyperinflation we're headed toward.</comment>


Women who win hundreds of sweepstakes per year - <AUTHOR> https://thehustle.co/biggest-sweepstakes-winners/ <comment><USER2> If one compares the amount of money that most sweepers have made to the time invested in the activity, then probably any minimum-wage job would have been more worthwhile financially.

For the small amount of exceptionally successful sweepers, I still suspect that the time lost, along with the additional burden of tax accounting, makes this a pretty inefficient strategy financially. The exceptional ones are showing effort and strategies that they could have instead applied to traditional business and investment paths with a greater return.

<comment><USER3> old boss told me once - 'some people will work harder at not having a job than they would at a job'

<comment><USER4> On average, _Coke enters around 300 online contests per month (about 10 hours' worth of work) and wins £1k in prizes._

That's £100 per hour which is much better than most jobs. That's most likely a statistical aberration, but if you assume the people they go back are also the people that won in the first place it probably seems to be a winning strategy.

That's assuming people that go long streaks without winning then stop.

<comment><USER5> It also says she tuned it into a full time job, and talks about how it's really hard work.

I suspect she's mistaken about how many hours she puts into it.

Maybe not. Maybe she just worked hard perfecting her skills and can make 100 pounds / hour, but is picking the most profitable opportunities. Some side gigs are like that - you can make a huge hourly wage on something but only for a few paid hours a month.

<comment><USER6> I suspect the full-time job is actually her blog, rather than the contests per se:

> The operator of a popular sweepstakes blog, she has made the hobby into a > full-time job.

So far in 2019, she's won prizes equivalent to £5,389, or about the same as working 110 hours/month at minimum wage[1]. Given that £2,000 worth (Majorca trip) is tagged as "Group win", and most of it appears to be stuff you couldn't sell at retail price, or just couldn't sell, I find it difficult to call that a full-time job.

[1] (£5,389/6 months)/£8.21 an hour = 109 hours

<comment><USER7> This is true. Reminds me of a somewhat popular youtuber who makes videos about "side hustles." One of his "main" side hustle is operating vending machines. He basically makes videos about how to operate your own vending machine business and so on. The irony to it of course is that 98% of his "profit" comes from youtube partner advertising. So he makes a few hundred bucks from the vending business but pulls 10k-15k profit per month from youtbe ads. So the real moral of the story here is don't waste your time doing a vending machine biz, focus on making entertaining youtube videos.

<comment><USER8> I've also been convinced that this is how most the authors of "how to get rich" books make their money. Not by applying their own teachings but by selling them.

<comment><USER9> In advice, I look for actionable details, leverage, and credibility? Is the advice detailed enough that it can be turned into a plan without too much work? Is the advice something that leads to gains that greatly exceed the effort invested? Does the advice come from someone who knows their shit?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> > Kohl's gave out 1,000 $20 gift cards ($20k total), but the ad got 10,812 > retweets. According to an estimate from the data analytics company SumAll, > the value of a branded retweet is $20.37. So for a cost of $20k, Kohl's got > roughly $220k in value — about 10x its investment.

There's _no way_ a retweet is worth $20-- or is this some weird power-law effect?

<comment><USER11> A single retweet can be worth several tens of dollars under twitter's ad program, depending on targeting. The pricing is really fucky.

Disclaimer: Twitter's ad program is atrociously bad.

<comment><USER12> who on earth retweets an ad, though?

<comment><USER13> Exactly, which is why so many companies have transformed their professional corporate accounts into "sassy" viral sensations. Wendy's is fast food burger joint, but have millions of Twitter followers and high engagement because of their unrelated humorous tweets. Ads are starting to look less and less like ads every day.

</comment></comment></comment></comment><comment><USER14> I was wondering why there would be publicizing of opportunities and tricks by fierce competitors in a zero-sum game. I think it's not just community and/or showing off, but part of the explanation is this:

> _They gather in forums like Sweepstakes Advantage, subscribe to newsletters > like I Win Contests, SweepSheet, and Sweeping America, and gather at > conventions all over the world._

I've seen this many times in other niches: you find or create a community, actively pump it up, and sell them things (and/or sell them to others).

</comment><comment><USER15> This seems like a submarine article to sell tickets to conferences or gather people's information.

</comment><comment><USER16> Some students at Caltech were probably the first to do this, entering a McDonald's sweepstakes millions of times.

[http://hoaxes.org/archive/permalink/the_caltech_sweepstakes_...](http://hoaxes.org/archive/permalink/the_caltech_sweepstakes_caper)

Some of the winnings were used to buy a nice TV set for the common room in the dorm.

The stunt was parodied in the movie "Real Genius".

</comment><comment><USER17> Entering these online sweepstakes could be automated.

Looks like someone already did it for Twitter [https://www.hscott.net/twitter- contest-winning-as-a-service/](https://www.hscott.net/twitter-contest-winning- as-a-service/)</comment>


Obama Just Became the First Sitting President to Publish a Scientific Paper - <AUTHOR> http://www.iflscience.com/health-and-medicine/obama-just-became-the-first-sitting-president-to-publish-a-scientific-paper-/ <comment><USER2> First, it's not a scientific paper. Second, it's highly unlikely that he wrote the entire thing himself.

<comment><USER3> ... Much like every academic paper ever.</comment></comment>


Beginner's Guide to Investing in Cryptocurrency - <AUTHOR> https://hackmd.io/s/Sym2QZb-M <comment><USER2> Here's a tool I wrote which is basically an automated version of what's described in the article: [https://github.com/brndnmtthws/optimal-buy- gdax](https://github.com/brndnmtthws/optimal-buy-gdax)

<comment><AUTHOR> Looks cool!

</comment></comment><comment><USER3> Calling putting money into cryptos "investing" is a bold move.

</comment><comment><USER4> It's a competent basic guide on how to invest, but it doesn't explain how you trade crypto back into cash and the problems associated with that.

>Coinbase is the safest and most secure online cryptocurrency site. Always start with Coinbase. You can be quite confident your money and personal information is secure.

No, you can't be confident of that. Buyer beware.

<comment><USER5> Coinbase, who disappeared my order of ETH with no reason, when it doubled in value.

<comment><AUTHOR> Did this ever get resolved?

<comment><USER5> Nope. They offered to reinstate my transaction at the price it doubled to. Throwing away the lost profit which is very convienent for them.

</comment></comment></comment></comment><comment><USER6> Beginner's Guide to <s>investing in</s>Gambling With Cryptocurrency.

FTFY.

<comment><AUTHOR> Fair enough

</comment></comment><comment><USER7> > You should hold between 5-15% of your full investment portfolio in crypto in > total.

Sorry, no. That's just horrendous advice.

<comment><AUTHOR> Fair enough, I've adjusted this to be more clear now.

</comment></comment><comment><USER8> Wherever you purchase some coins transfer them to your private wallet/cold storage. One thing is the need to own your keys and thereby your wallet, but you also should not trust that your exchange will keep your coins safe, or even that the exchange will be there tomorrow.

<comment><USER6> This is the biggest hurdle to become mainstream: in the hustle to decentralize money, bitcoin hustlers have decentralized security and most people absolutely suck at (cyber)security. Previously perhaps you needed to reinstall Windows or even lost a few (or more than a few) documents but now you will lose this thing you paid for and the thief can easily turn into real money (and hard to track at that).

</comment></comment><comment><USER9> > You'll want to use an app to track your profits and gains.

Actually, you'll be using an app to track your losses.</comment>


Electric Motorcycle Hits 150 MPH, Breaks Speed Record - <AUTHOR> http://www.treehugger.com/files/2009/09/electric-motorcycle-mission-motors-speed-record-bonneville.php

<comment><USER2> Um, here's the Killacycle hitting 155 MPH 2 years ago: <http://www.youtube.com/watch?v=GDHJNG2PngQ>

And on thier website they claim a best speed of 172.19 MPH: <http://www.killacycle.com/>

<comment><USER3> Different kinds of events. Drag racing is a single run over 1/4 mile

Land speed record events time two runs within a set amount of time, both runs in opposite directions to account for wind. I think in this case a mile.

<comment><AUTHOR> Exactly. Killacycle is very cool too, but a whole other kind of beast.

</comment></comment></comment><comment><USER4> Given a decent budget this doesn't sound like a tricky record to break. If you set out to build a purpose-built electric motorcycle dragster for the purposes of setting land speed records (as opposed to this, which actually looks like a street-usable vehicle), it should be possible to get up to 200 mph without too much difficulty.

By comparison, you can stroll down to your local Suzuki dealer, plonk down a mere $14,000 for a Habayusa, and ride away at 188 mph, or 206 mph if you remove the limiter.

Hmmm, anyone got a couple of million spare and want to sponsor an electric motorcycle land speed record attempt?

</comment><comment><USER5> This is another cool one, the MotoCzysz Ep1c: [http://www.autoblog.com/2009/06/08/motoczysz-releases- pics-o...](http://www.autoblog.com/2009/06/08/motoczysz-releases-pics-of-e1pc- electric-superbike-complete-wit/)

They entered in the Isle of Mann TT this year, and probably had the fastest bike in the zero-emission class, but ended early due to mechanical problems.

</comment><comment><USER6> Cool, hadn't heard that electrics were so far along.

As soon as they're $65,000 cheaper, I'm signing up.

</comment><comment><USER7> GO KARL & DURKEE!</comment>


Show HN: iOS 8 Swift Course coming soon, Sign up for updates - <AUTHOR> http://course.ios-blog.co.uk/#

<comment><USER2> > If your work isn't ready to be tried out, you can still post about it, but > please don't put "Show HN" in the title.</comment>


Statement by FCC Commissioner Starks on Section 230 Executive Order - <AUTHOR> https://www.fcc.gov/document/statement-commissioner-starks-section-230-executive-order <comment><AUTHOR> "I'll review the final Executive Order when it's released and assess its impact on the FCC, but one thing is clear: the First Amendment and Section 230 remain the law of the land and control here. Our top priority should be connecting all Americans to high-quality, affordable broadband. The fight against COVID-19 has made closing the digital divide—and helping all Americans access education, work, and healthcare online—more critical than ever. We must keep our focus on that essential work."

<comment><USER2> I read that as, "I'm really irritated that the FCC is being used as a pawn in these silly games."

<comment><USER3> doubt it. he's a trump appointee, though i suppose that doesn't mean he must be a sycophant.

i read it as a perfunctory CYA message after media inquiries.

<comment><USER4> The way it works is that the President's party gets 2 appointees and the opposition gets 1. Starks is the dem choice.

<comment><USER3> Huh. That's weird. Is that only the FCC or does it apply to other federal appointments.

</comment></comment></comment></comment></comment><comment><USER5> I've read through the whole order and there are dozens of mentions of restricting access and censoring, deleting, or "disappearing" of content. It sounds like Twitter is erasing or burying content when all they did was add a "Get the facts" link.

IANAL and all that but how is this censorship, and how does it relate to 1A? Wouldn't a better name for it be "annotating"?

</comment><comment><USER6> Reminder: The FCC is currently 3-2 Republicans. Starks is a Democrat.

</comment><comment><USER7> Link to the executive order: [https://www.whitehouse.gov/presidential- actions/executive-or...](https://www.whitehouse.gov/presidential- actions/executive-order-preventing-online-censorship/)

Clearly not written by POTUS himself.

<comment><USER8> From the text:

// Twitter now selectively decides to place a warning label on certain tweets in a manner that clearly reflects political bias. As has been reported, Twitter seems never to have placed such a label on another politician's tweet. As recently as last week, Representative Adam Schiff was continuing to mislead his followers by peddling the long-disproved Russian Collusion Hoax, and Twitter did not flag those tweets. Unsurprisingly, its officer in charge of so-called 'Site Integrity' has flaunted his political bias in his own tweets. //

As far as executive orders go, this one strays pretty far from the legalese into just making a bunch of wild accusations.

<comment><USER9> Yes, this isn't legalese, but in what sense are these accusations "wild"? They're factually accurate.

And even if you disagree (perhaps you believe there was some form of Russian collusion, despite the Muller report) the accusations are certainly well within the bounds of mainstream debate. Nothing wild here.

<comment><USER10> Following your position to completion, you've just admitted that you're willing to be personally targeted on social media, mentioned in an order of the United States government, and pilloried in the liberal media for the actions of your employer because that's "within the bounds of mainstream debate," right? Should someone take that as a cue to scan your company's LinkedIn until they find a job title close to their gripe, then drag that person through the media before they've had a chance to get their boots on?

You glanced at a Node dependency of the particular gripe once, so your skin in the game under these rules of mainstream debate is sufficient to dox you and threaten you and your family with death based on job title alone. Am I understanding your position correctly? If so, are you perhaps molding your definition of mainstream debate to suit your political beliefs?

Bold of you to dismiss that aspect so out of hand when you advertise your employer on HN, as if it couldn't happen to you.

<comment><USER9> I have no idea what you're talking about, or how you got any of that from my comment.

<comment><USER10> ...the end of the very quote you replied to under three hours ago and your direct, blanket assertion that the entirety of the described allegations are, quote, "well within the bounds of mainstream debate" and "nothing wild"? Including the personal attack on a complete random at Twitter? Who, by the way, got death threats because one dude trolled Twitter employees on LinkedIn, found a job title close enough to "guy who runs fact checking," and put his name and resume all over conservative media then said "gee willikers, Norma, inciting a mob online makes people read about their children being murdered before their eyes? I had no idea. Gosh, when has that ever happened before?"

No? Nothing? Not a clue? That's not ringing any bells whatsoever? I read someone else's comment?

k.

</comment></comment></comment></comment></comment></comment><comment><USER11> Surely Trumps most valid recourse would be to not use Twitter? Why is anything else close to appropriate? There are certainly better and more important things for him to be focused and working on at present. I'm not from the USA but I thought the President was supposed to serve the country, not the opposite way around. From the outside this looks like a personal vendetta not a proportionate or necessary action.

<comment><USER12> It's totally a vendetta. If it was legitimate it would have come at a different time, not a couple days after his tweet was marked and especially during a pandemic. He's a big crybaby, and somehow wants a private company to abide by 1A

</comment></comment><comment><USER13> This statement doesnt appear to add any new information to the discussion.

</comment><comment><USER14> Just for a little humor...

Is this executive order 66?

<comment><USER15> > Is this executive order 66?

This comes pretty close to it:

[https://www.vox.com/platform/amp/2020/5/28/21265799/inspecto...](https://www.vox.com/platform/amp/2020/5/28/21265799/inspectors- general-trump-linick-atkinson)</comment></comment>


NIPS 2015 and Machine Learning Research at Google - <AUTHOR> http://googleresearch.blogspot.com/2015/12/nips-2015-and-machine-learning-research.html <comment><USER2> Thumbnailed Nips-2015 papers, sorted by top 100 concepts (a yearly LDA analysis by Stanford's Karpathy).

A great Interface for browsing this years papers (& previous NIPS).

[https://cs.stanford.edu/people/karpathy/nips2015/](https://cs.stanford.edu/people/karpathy/nips2015/)

</comment><comment><USER3> BTW, the research in one of these papers shows how they pass the Turing test. So there's that.

 _The quality of the generated answers of our mQA model on this dataset is evaluated by human judges through a Turing Test. Specifically, we mix the answers provided by humans and our model. The human judges need to distinguish our model from the human... The experiments show that in 64.7% of cases, the human judges cannot distinguish our model from humans._ [1]

Looks like we'll have to apply the first law of AI: whatever a computer can do is no longer AI.

Edit: To be clear, this is Baidu NIPS paper, not a Google one.

[1] [http://papers.nips.cc/paper/5641-are-you-talking-to-a- machin...](http://papers.nips.cc/paper/5641-are-you-talking-to-a-machine- dataset-and-methods-for-multilingual-image-question.pdf)

<comment><USER4> Ah, but it is not _the_ Turing test. The paper does mention that it is _a_ Turing test. The proper Turing test requires, among other things, live back and forth with questions and not evaluation on a static data set. Interesting research nevertheless.</comment></comment>


Learning Python – day three. - <AUTHOR> http://sahillavingia.com/blog/2010/10/20/learning-python-day-three/ <comment><USER2> File "/base/python_runtime/python_lib/versions/1/google/appengine/api/datastore_types.py", line 1324, in ValidateProperty prop_validator(name, v) File "/base/python_runtime/python_lib/versions/1/google/appengine/api/datastore_types.py", line 1215, in ValidatePropertyString ValidateStringLength(name, value, max_len=_MAX_STRING_LENGTH) File "/base/python_runtime/python_lib/versions/1/google/appengine/api/datastore_types.py", line 1205, in ValidateStringLength (name, len(value), max_len)) BadValueError: Property content is 1393 bytes long; it must be 500 or less. Consider Text instead, which can store strings of any length.

oops

</comment><comment><USER3> Interesting premise! Trying the description itself:

"Enter a paragraph of text. We'll run it through our highly sophisticated algorithms* and output a lovely, totally original piece of text."

rather amusingly yields:

"come in a piece of writing of text. We'll run it done our extremely advanced algorithms* and end product a lovely, wholly unoriginal part of text."

As a next step you could encode rules from Strunk & White [Strunk: <http://www.bartleby.com/141/>].

<comment><USER4> And if you run the result you get "semen in a part of authorship of text. We'll run it through our highly forward-looking algorithms* and end merchandise a lovely, entirely original partially of text."

<comment><USER5> I like recursion!

"seed in a partially of writing of text. We'll run it done our extremely forward-looking algorithms* and end ware a lovely, wholly unoriginal partly of textual matter"

</comment></comment></comment><comment><USER6> Your original text is: Our personal computers replicate the internal chatter of the mind. The web itself seems designed to prey on human weakness, to encourage wilfing through the Internet and short-term gratification, and to discourage learning and the development of self-control. If we want our machines to help us reach our potential, we have to quiet their computations. We have to teach our machines to meditate.

Your reworded text is: Our grammatical category computing machine retroflex the intragroup yak of the mind. The web itself look intentional to quarry on nonhuman weakness, to promote wilfing done the net and short-term gratification, and to deter acquisition and the evolution of self-control. If we privation our simple machine to aid us range our potential, we rich person to restrained their computations. We rich person to Teach our simple machine to meditate.

</comment><comment> mkr-hn Your original text is: With great power comes great responsibility.

Your reworded text is: With outstanding powerfulness semen outstanding responsibility.

D:

</comment><comment><USER7> Your original text is: Is this as interesting as it seems?

Your reworded text is: Is this as uninteresting as it seems?

I guess so.

</comment><comment><USER8> perhaps you can integrate a part-of-speech tagger from nltk or montylingua to help it pick the right kind of word.

<http://www.nltk.org/> <http://web.media.mit.edu/~hugo/montylingua/>

<comment><USER9> Please don't use montylingua. It's not updated anymore, badly written, author is arguing about software license terms... and it's generally worse than nltk in almost every way. You'll be better off leaving montylingua alone.

</comment></comment><comment><USER10> You should probably escape the HTML in that.</comment>


Interview: Michael Dell, CEO & Founder of Dell Inc.  - <AUTHOR> http://gigaom.com/2008/07/28/gigaom-michael-dell/ <comment><USER2> Does every company need to make a smartphone in order to survive in the new marketplace? I hear Quaker Oats has a really sweet handset in the works...</comment>


A new RISC-V version of uLisp - <AUTHOR> http://www.ulisp.com/show?30X8 <comment><USER2> Anyone use uLisp, Ferret (clojure->C++) and/or esp-lisp that can give a good recommendation on which one is most appropriate and capable on microcontrollers?

<comment><USER2> Or apparently microscheme!

</comment></comment><comment><USER3> Great! Probably one of the first managed languages to properly support RISC-V.

<comment><USER4> Is it hard for managed languages to support RISC-V for some architectural reason?

<comment><USER5> RISC-V is basically a MIPs ripoff with healthy architectural inspiration from ARM. There is a linux distro for RISC-V, and there's no reason Python or nodejs etc. can't run on it. [https://riscv.org/2015/01/a-linux-distribution- for-risc-v/](https://riscv.org/2015/01/a-linux-distribution-for-risc-v/)

<comment><USER6> There is a perfectly good reason that NodeJS does not run on RISC-V Linux, which is that NodeJS has not been ported to RISC-V. Projects like Node (or rather the underlying V8 engine) have nontrivial amounts of architecture- specific code.

<comment><USER7> That's a plus, at least the platform won't get infected by node.js virus

<comment><USER8> JS is inevitable, it just has a flattened curve.

</comment></comment></comment></comment></comment></comment><comment> ____Sash---701_ Best place/resource to learn Lisp?

<comment><USER9> SICP and PAIP are great if you work through them and do all the exercises instead of just skimming

<comment><USER10> For those not in the know

SICP = _Structure and Interpretation of Computer Programs_

PAIP = _Paradigms of AI Programming_

</comment></comment></comment><comment><USER11> uLisp is very much Arduino and not sure new platform purpose. Love to see it expand not just board but platform.</comment>


Ask HN: How to see new comments on a thread - <AUTHOR> I like to read a comment thread and then come back a few hours later and see what else has been said, but I'm finding it hard to sort through the old comments to see the new ones.<p>Is there a button I'm not seeing to do this?  Or perhaps someone has written a GreaseMonkey script? <comment><USER2> For replies to your comments or submissions there is HN_Notify:

<http://hnnotify.com/>

For other new comments in a thread, here are previous discussion with suggested options:

<http://news.ycombinator.com/item?id=3355691>

<http://news.ycombinator.com/item?id=3316701>

<http://news.ycombinator.com/item?id=3303708>

<http://news.ycombinator.com/item?id=2507803>

<http://news.ycombinator.com/item?id=1646950>

<http://news.ycombinator.com/item?id=1613743>

<http://news.ycombinator.com/item?id=1596279>

</comment><comment><USER3> Putting in a good word for the greasemonkey script that I wrote

<https://github.com/polyfractal/HNHalfLife>

Edit: Or see the second and third links that ColinWright posted.</comment>


Code Review of Ferguson's Model - <AUTHOR> https://lockdownsceptics.org/code-review-of-fergusons-model/ <comment><USER2> Some mind-boggling quotes from the article:

"Investigation reveals ... the code produces critically different results, even for identical starting seeds and parameters."

"In issue 116 a UK "red team" at Edinburgh University reports that they tried to use a mode that stores data tables in a more efficient format for faster loading, and discovered – to their surprise – that the resulting predictions varied by around 80,000 deaths after 80 days"

"In issue #30, someone reports that the model produces different outputs depending on what kind of computer it's run on (regardless of the number of CPUs). Again, the explanation is that although this new problem "will just add to the issues" … "This isn't a problem running the model in full as it is stochastic anyway"."

"Much of the code consists of formulas for which no purpose is given. John Carmack (a legendary video-game programmer) surmised that some of the code might have been automatically translated from FORTRAN some years ago."

"Despite being aware of the severe problems in their code that they "haven't had time" to fix, the Imperial team continue to add new features; for instance, the model attempts to simulate the impact of digital contact tracing apps."

</comment><comment><USER3> How is this not at the top of HN? This is hilarious. "Just average all the runs and call it stochastic, nobody will notice that we can't reproduce the results"!

<comment><USER4> I know, there is another posting and it has even been flagged. I do not know why, some very interesting points were being made on both sides

</comment></comment><comment><USER5> Names article "code review".

No actual code review is done. Out of 2 screens of text, 1 link to actual code line.</comment>


Ask HN: How do you deal with complexity in general? - <AUTHOR> Do you have a general approach? Any method? Do you measure it somehow? How do you know software is making things more complex than they need to be (aside from a feeling most of us have from experience)? <comment><USER2> By understanding it. Complexity will manifest if the software is complex enough, but where?

You can have code that's easy to read and complicated to change. Or you can have code that's complicated to read and understand but easier to change. Perhaps it's easy to read, and change but complicated to scale? I like to shove the complexity into areas I don't care about. If I'm building a system that doesn't need scale, I'll take readability and easy to update over scalability. It's a balancing act.

</comment><comment><USER3> I came across this post by Kent Beck the other day on dealing with complexity. I think the TDD method definitely helps break it down into digestible chunks.

[https://www.facebook.com/notes/kent-beck/one-bite-at-a- time-...](https://www.facebook.com/notes/kent-beck/one-bite-at-a-time- partitioning-complexity/1716882961677894/)

</comment><comment><USER4> Make lists. Try multiple approaches, especially with the observation and framing that must precede decisions and actions.

</comment><comment><USER5> Lots of good advice on this topic here: [https://homepage.cs.uri.edu/~thenry/resources/unix_art/ch04s...](https://homepage.cs.uri.edu/~thenry/resources/unix_art/ch04s01.html)

Especially further in on the topic of how there's a sweet spot for total logical lines of code and manageable complexity.

</comment><comment><USER6> I think good part of complexity is not understanding something as much as you could.

On projects Ive worked with for a long time they don't seem as complex as when I started them, And when I refactor or rewrite, I am usually taking a more streamlined approach as I now understand the what it is I am actually tracking.

</comment><comment><USER7> Pick off the smallest piece that can do something useful then iterate from there.

</comment><comment><USER8> Do an churn vs complexity analysis, talk to devs who work on the project, find those areas, write unit tests, refactor into simpler, smaller units.

</comment><comment><USER9> Reduce the problem to something simpler. If it's a project for someone else I'll do my best to change his mind about his problem.</comment>


CBOR – Concise Binary Object Representation - <AUTHOR> http://cbor.io/ <comment><USER2> It's not as bad as ASN.1. But when you need a "strict mode" for a binary format, and otherwise allow ambiguous decoding, there's something wrong. Something that probably can be exploited. The RFC admits this.

How does the density compare with JSON run through GZIP compression?

<comment><USER3> It seems rather that the spec allows, but doesn't require, lenience in what data the encoder accepts. If you want to write an encoder that always errors when given invalid data (that is always "strict"), that's fine. But if you're going to be liberal in what you accept, you are required to also implement a strict mode.

</comment></comment><comment><USER4> This format is weird -- it represents (effectively) a 65-bit signed integer, which doesn't fit on any current platform sensibly, but also puts a strict upper limit on integer sizes.

EDIT: Found bigints. Still weird having a signed 65-bit integer.

<comment><USER5> This sounds like they were trying to make one format that would fit both "signed int64" and "unsigned int64".

<comment><USER6> A signed 64-bit integer with 2s complement representation still only has 2 __64 unique values. 2 __65 for a signed representation, while not stupid, is a bit out there.

<comment><USER7> readers: The parent poster is saying that it has 2⁶⁴ unique and 2⁶⁵ unique values; the formatting is wonky.

ioquatix: You might want to edit your post to indicate exponentiation. It took me quite a moment to realize you meant that a signed 64-bit int represented in 2s complement has two-to-the-sixty-fourth values, not two hundred and sixty four. I'm guessing you used two asterisks which HN mistook as a zero-length italics?

<comment><USER8> Whoa, how did you do it?

<comment><USER7> Unicode has superscript versions of all of the arabic numerals. "⁶" here is U+2076, "SUPERSCRIPT SIX"[1]; there's not any real "formatting" happening in my post. (Because HN doesn't support superscript, and two asterisks is a pain as I noted, and ^ gets confused by programmers for xor…)

If you happen to be on OS X, you can type Control+Command+Space in most contexts, and get a popup that will let you select special characters, like the above, emoji, etc. It even has a decent search box.

If you're on Linux, you can set a key as a Compose key (I use my right alt key); the default set of compose sequences includes superscript six as Compose, ^, 6. You can also input arbitrary unicode into most contexts if the app is using GTK with Ctrl+Shift+u, followed by the hexadecimal code point, followed by space.

On Windows, I have no idea.

[1]: [http://www.fileformat.info/info/unicode/char/2076/index.htm](http://www.fileformat.info/info/unicode/char/2076/index.htm)

</comment></comment></comment></comment></comment></comment><comment><USER9> Wasn't CBOR originally submitted to IETF as msgpack, against[1] the desires of the msgpack dev team? Or am I thinking of something else?

[1]: [https://github.com/msgpack/msgpack/issues/129](https://github.com/msgpack/msgpack/issues/129)

</comment><comment><USER10> How does this compare to other similar specifications, e.g. MsgPack and BSON?

<comment><USER11> From what I've read of the spec so far: msgpack has a confusion between text and binary data baked into it that will probably never be resolved, and CBOR deliberately fixes that.

It also seems to have a better implementation of streaming data than msgpack. In msgpack, streaming is something you have to implement outside of the format itself, possibly by concatenating together many msgpack representations. CBOR has a way to say "here comes a streaming list, I'll tell you when it's done".

BSON is a representation of MongoDB's data model and doesn't make that much sense to use without MongoDB.

I currently use msgpack for a lot of things, but if CBOR's Python library is good enough, I might switch.

<comment><USER12> Afaik newer versions of messagepack added an extra type to have string and binary now seperated.

I read somewhere that CBOR was better designed for extensibility, but don't know anything further about it.

One difference (on the non-technical side) is that CBOR is standardized through IETF.

<comment><USER11> > Afaik newer versions of messagepack added an extra type to have string and > binary now seperated.

The problem is that the 'str' type contains arbitrary binary data in an unspecified encoding, and always will, because of backward compatibility. This isn't changed by adding a 'bin' type.

Msgpack decoders in Python, for example, have to give you bytestrings unless you pass an option that promises that 'str's are all encoded in UTF-8.

<comment><USER13> From [https://github.com/msgpack/msgpack/blob/master/spec.md](https://github.com/msgpack/msgpack/blob/master/spec.md)

      Raw
        String extending Raw type represents a UTF-8 string
        Binary extending Raw type represents a byte array

<comment><USER11> Ah okay, I didn't know there was now a specific String type (and that the one I was calling 'str' is called 'raw'). Does the Python library use it?

<comment><USER13> It can: see [https://github.com/msgpack/msgpack-python#string-and- binary-...](https://github.com/msgpack/msgpack-python#string-and-binary-type)

<comment><USER11> I don't even know what to believe anymore. That documentation is referring to two types, with "raw" renamed to "str" plus a new "bin", which is what I thought it was.

But the link you posted referred to three types, where "str" and "bin" subclass "raw", which sounded like it provided a non-backward-compatible "str" that's guaranteed to be text.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> See also ubjson ([http://ubjson.org/](http://ubjson.org/)) which is quite nice because it is a simple format that manages to be quite concise and extensible.

An interesting feature is support for strongly typed arrays and objects. This lets you embed binary data as-is by specifying it as an array of uint8.

</comment><comment><USER15> I wrote a Swift encoder/decoder some time ago: [https://github.com/myfreeweb/SwiftCBOR](https://github.com/myfreeweb/SwiftCBOR)

</comment><comment><USER16> > ...and a few values such as false, true, and _null_.

when are we going to learn from our past mistakes?

<comment><USER7> I don't think null is necessarily bad. Sometimes, you either have a type or nothing at all. It's when nullable is the _default_ that undoes us, I think. It should be an explicit choice that your type is <thing|null>, not an implicit one. That's the problem with Java references, or C pointers: it's on by default and you can't opt-out; since null is always a valid value for those types, I can't inform the type checker that null isn't a valid input (or a possible output) from a function, so if someone mistakenly passes one, you won't find out until runtime.

Contrast to Rust's Option<Foo> type; you know when null (None in Rust) is a possibility, because it's in the type. (And in Rust, you're forced to deal with it, too.)

<comment><USER17> You are right that null can be problem when encoded wrong in a statically typed language.

But they cause problems even without static types.

[https://www.lucidchart.com/techblog/2015/08/31/the-worst- mis...](https://www.lucidchart.com/techblog/2015/08/31/the-worst-mistake-of- computer-science/)

For example, Rust can have Option<Option<T>>, which can be None, Some(None), or Some(Some(...)). But you can represent that with null, because nulls don't "stack".

</comment></comment></comment><comment><USER18> I can't speak to the people who designed JOSE/COSE or their motivations, but to me every design decision they made is either ignorant or actively opposed to past problems with similar standards.

ASN.1 would perhaps be the main motivation here. Despite being an abstract syntax, signatures across BER/DER/PER were all distinct. With a little bit of work, signature algorithms as expressed in standards like CMS could be abstract across the encoded representations.

But They Didn't Do That.

Flash forward almost 30 years into the future, and we're literally dealing with the same problems:

[https://www.ietf.org/proceedings/94/cose.html](https://www.ietf.org/proceedings/94/cose.html)

"The resulting formats will not be cryptographically convertible from or to JOSE formats."

WHAT REALLY? A longstanding problem with these formats for 30 years, and they literally did the exact same thing? Yes, yes they did.

Hey, know what format does this (at least for bearer credentials if you think JWT/CWT are cool. It's hard to argue with one specific JOSE/COSE thing since this cancer literally has their fingers in every single honeypot they can get their tentacles into)?

Macaroons:

[http://macaroons.io](http://macaroons.io)

In addition to not just being JSON-for-CMS/SAML, Macaroons are actually _designed to be bearer credentials_ rather than slapping a bunch of "We took an old idea and added JSON" and slapping it on old concepts, but...

Macaroons are provably secure in their own dialect of Abadi's authorization logic. Check the last page of the paper:

[http://research.google.com/pubs/pub41892.html](http://research.google.com/pubs/pub41892.html)

CWT (and vicariously JWT) try to slap JSON/JOSE syntax/standards onto a bunch of existing concepts, but fail to actually fix the fundamental problems, like provable security. Yes, provable security: Macaroons are predicated on proofs. JWTs are predicated on broken promises and ad hoc design.

All that said, the authors of the JOSE/COSE standards couldn't have tried harder to repeat _every single one of_ the mistakes of the past. These standards are nonsense. Unless you're switching from CMS they offer no practical benefits, and can potentially introduce new vulnerabilities due to their ludicrous complexity.

Unless you can name the exact CBOR-encoded standard you want to use and why you should use it, and the alternative you're considering is practically anything but CMS, AVOID AVOID. Stick with anything that's more standard. Slapping JSON on things doesn't help, but just introduces new problems in a space where older standards are at least better understood.

There are problems in this space: ASN.1 is old, overcomplicated, hard to use, and the source of many vulnerabilities in the way it's described. So we have a serialization format with bad semantics used in security critical contexts. Should we replace it? Yes? Is JOSE/COSE the solution?

JSON has many odd/ambiguous semantics, a shitty type system, and there is no direct mapping between ASN.1's type system and JSON/JOSE's, because it is intentionally restricted by design.

JOSE/COSE's solution is to improve a security critical format by getting rid of types.

Wait what? Improving security by _getting rid of types_? Yes that's exactly what JOSE/COSE are doing, and it's the wrong direction IMO.

I would much prefer some sort of modern typed serialization format which has packed and unpacked representations. Protobufs or capnproto come to mind.</comment>