Ask HN: What changes in your life did you make to become more productive? - <AUTHOR> <comment><USER2> Went to my doctor for the first time about what turned out to be undiagnosed/untreated comorbid depression and ADHD. I was apprehensive and avoided it for years but it's easily been one of the best decisions I've ever made. I was losing so much time to the vicious cycle of not wanting to do anything but lay in bed, then feeling crappy that I wasn't doing anything, then trying to focus but constantly geting distracted for several hours, then feeling crappy about all of that and just wanting to go back to bed. (And obviously, I have seen enormous improvements in my overall mental health and well-being, not just productivity. But it turns out that not feeling like crap most of the time also makes you a much more productive developer.)

<comment><USER3> What was the treatment?

<comment><USER2> For me, it started with an antidepressant (escitalopram, commonly called Lexapro) and weekly visits with a therapist. The escitalopram did wonders for my particular depression. I have dysthymia (also called persistent depressive disorder, I forget which is the official name now) which means I experience ongoing, low-level daily melancholy (as opposed to clinical depression/major depression, which is much more episodic in nature -- you have weeks you just can't get out of bed or eat, and you have weeks when you're pretty much fine). So for me, escitalopram did a ton to even out my daily melancholy and limit mood swings -- I still have good and bad days but my baseline is much closer to neutral rather than consistently feeling down in the dumps.

And then as I talked to my therapist over time she uncovered symptoms of ADHD that I'd never really thought about. There's a lot of debate about whether adult-onset ADHD exists, but her perspective (which seems very accurate in my case) is that people with "adult-onset" ADHD have actually had it their entire lives as well, but they had better coping mechanisms so it wasn't diagnosed at a young age. I was always a good student, rarely got in trouble, could sit still in the classroom -- but I had a terrible time trying to focus on work, I fidget constantly, I always have multiple trains of thought in my head. I'm just also a pretty fast worker and fairly smart so I was able to be unfocused and put things off to the last second but eventually lock it in just in time to beat the deadline. My therapist administered a diagnostic test (basically a multiple choice test asking about how often I experience X, Y, and Z, and a similar test sent to a close friend to be completed separately about their perceptions of me) and it turned out that I do have ADHD. So she started me on Ritalin which has also helped me immensely. I'm able to focus and be productive on a regular basis (rather than in brief but manic spurts) and it also helps my overall mood, because I'm not constantly getting down on myself for being unable to focus on something important. (That's what it means for my ADHD/depression to be "comorbid" \-- they feed into each other.)

It's worth noting that this is just my particular combination of neurodivergences and treatment plan. Different people experience success with different treatments, including various medications, ongoing/regular talk therapy, lifestyle changes, etc. But the one constant is that I've never met a single person whose life has gotten worse because they talked to someone about their mental health. It's a lifelong journey but in my experience the needle only moves in one direction and it starts with opening up to someone.

</comment></comment></comment><comment><USER4> In order of impact:

* Stop looking for "opportunities" until I need one. This means entertaining recruiters, personal branding, networking, coupons/free stuff, freelance sites, side projects, meeting sales people. 80% of errands I didn't want came from this. The only exception is helping people who ask for help.

* Getting the hardest thing done a day. Sometimes this means getting rest and sleeping at 9 PM.

* If it feels bad to the point I rant for nights to my wife about it, get rid of it. Fire that guy, send that email, yell at the boss, quit that job, destroy that rival. Sometimes it costs me all my daily willpower to do this one thing, and I end up too tired to do anything else. It's always worth it.

* Focus days. Basically these totally monastic days, where I stay away from all entertainment and think on a problem, except for family time. You know that moment you get an idea in the shower? When avoiding all entertainment, you get that moment all day, and it wanders off to something useful, not about how to optimize my build for a game.

* Never directly working past 6 PM. Daydreaming about work is fine but don't write anything.

* Getting 7 hours of sleep a night. 1 extra hour of sleep allowed 2 more hours of difficult work.

* L-Theanine

* Exercise regularly in mornings.

* Disposable prototypes. If I feel unsure if something could be done or unsure how to do it, build something that will be disposed later. Forcing myself to throw it away also keeps me from adding stuff I don't actually need and keeps me from paralyzing perfectionism.

* Don't emotionally focus on something. Bad things hurt, but focus on getting back up or away from the pain. Don't let it distract.

* Yes, fear/depression/anger increase productivity 500%. But the side effects are very bad.

<comment><USER5> what is L-Theanine for?

<comment><USER6> It's a calming nootropic that goes really well with caffeine. (It's why green tea is so great.)

<comment><USER5> I am drinking green tea (a lot actually). Should I also ingest L-Theanine?

<comment><USER6> I think the nootropics people claim that most green tea has a little bit too little L-Theanine to get the most out of it biochemically, but I'm not sure.

They first extracted L-Theanine from Japanese gyokuro tea, which is green tea grown in shade and it has a lot of the wonder drug, but it's pretty expensive.

Anyway, green tea is great as it is, so it's up to you!

</comment></comment></comment></comment></comment><comment><USER7> Strengthen my self-discipline muscle. Seriously the ability to self-control ourselves is the biggest and hardest thing.

1) I HATE Running and I would run 3 miles a day around a 1/4 track 5 days a week. I could stop at anytime and just did it.

2) I fasted breakfast and lunch once a week. Just drank water period.

This was awesome then I got married and have kids. I am the most undisciplined self I have ever known and less productive.

<comment><USER8> 1st off, username checks out.

>I am the most undisciplined self I have ever known and less productive.

Are you saying this is a result of marriage+kids or 1&2 above?

</comment></comment><comment><USER9> Serving in the army (and actually going to war, which is a nightmare, for a brief period):

1\. It helps you get discipline right, and care less about "productivity" and "motivation" \- you just do stuff. 2\. It teaches you that your reserves and powers are limited, and priorities are an hourly grind of making the right choices. 3\. It teaches you to stay sharp all the time, no matter what your body tells you to feel.

Not that I've mastered any of these, but even small hints I've picked up really changed my life before/after spending 6 months in pre-field training and a year in field (I was officer-in-reserve before, but it teaches you knowledge, not skill).

<comment><USER10> The two friends I know who went to war had to shove dead kids into trucks. One is a functioning alcoholic and the other is a recluse whose nickname has "drugz" in it. Good luck with that as a self-motivating strategy.

</comment></comment><comment><USER11> No 0 days.

Taken from this thread on reddit: [https://www.reddit.com/r/getdisciplined/comments/1q96b5/i_ju...](https://www.reddit.com/r/getdisciplined/comments/1q96b5/i_just_dont_care_about_myself/cdah4af/)

<comment><USER12> Reminds me of the make-your-bed advice. [http://www.businessinsider.com/navy- seal-commander-explains-...](http://www.businessinsider.com/navy-seal- commander-explains-why-you-should-make-your-bed-2017-4)

</comment></comment><comment><USER13> I ditched my smartphone and opted for a dumb phone instead. For me, having a smartphone made my distractibility even worse than it naturally is (I have ADD). Also, I no longer hear the siren call of the internet calling to me everywhere I go.

<comment><USER14> Was it hard to make the transition? I wish I could get rid of my smart phone, but I'm so dependent on lyft, my gps, etc, that it's hard to separate the addictive parts from the parts that are really useful.

<comment><USER13> Well, I have a Garmin for GPS (which is arguably inferior but it's fine) and I don't live in an big city so we don't have Uber or Lyft here anyway. I can see how for some people it is a requirement to have a smartphone - esp if you need to be constantly tethered to your email (dev ops etc...)

<comment><USER15> so the trick is not ditching your device access to online stuff, but your physical access. without a cellphone in big urban centers you'd have a tough time moving around. well, I would.

public transport in big us cities are broken down by little cities, which any European would call neighbourhood... and parking in sf and ny is impractical. now you have to know how to transfer between several buses routes, or even if you decide to just take a cab, you must know the cab number for the company for that specific little region you find yourself at. I can't imagine not having a phone with a browser to navigate this mess, obviously designed to limit mobility.

</comment></comment></comment></comment><comment><USER8> Meal prep once a week.

Once a week I roast ~8 chicken quarters (I quarter whole chickens). M-Th the only meals i eat are 2-4 cups of mixed salad and 1/4 chicken. Takes about 1 hour to prep, saves about 6 hours of time per week.

Intentionally do less. I frequently trim back all the things I think I "have" to do and realize they're not worth the marginal time. This includes things like cleaning my apartment (once a month instead of once a week). Checking email besides when I find my self waiting for something else (like an elevator or coffee). I also try to keep this mentality with development. I try to code the least thing and get it shipped so that we can improve it if/when someone ever uses it. The vast majority of P0 Must have CEO direct features have been largely untouched and thus I now just do the bare minimum on things so we can get the data to know where to focus real effort.

<comment><USER16> I would hate chicken after few weeks of such diet )

</comment></comment><comment><USER17> The biggest change for me has been partitioning. When it is time to work, I work. No distractions, attack the most important tasks etc. During breaks I will let my attention wander but not during work periods.

When I am participating in hobbies, with friends, on vacation, done for the day etc I do not work. I will not check my email, I will not answer phone calls, I will not do any work. Obviously if there is an emergency I will break this policy, but true emergencies are pretty rare. I schedule both work time and time off in my calendar and make it available for people I work with to see. They know that unless it's an emergency, if they contact me during a marked time off they will not get a response until the next work period.

</comment><comment><USER18> I've never made a change in my life with the conscious purpose to become more productive. But there have been a couple of periods in my life when my productivity was higher, so it was tempting to examine what circumstances were present that could explain those good times.

I have no positive answers. It's more like I am usually very productive as long as there's not some circumstances that slow me. Actually it's very easy to find the causes for my _lack_ of productivity: illness, family problems or toxic workplace.

So my advice is: get the monkey off your back and forget the details.

</comment><comment><USER19> Try FaceApp and see yourself aged 30+ years. You will eventually become that person so it's worth taking steps towards making that person the best version of you.

"We treat our future selves like strangers" [https://www.vox.com/2014/12/18/7414105/procrastination- futur...](https://www.vox.com/2014/12/18/7414105/procrastination-future- planning)

</comment><comment><USER20> I stopped caring how productive I was and just produced stuff when I felt like it

</comment><comment><USER21> Ditched multiplayer roleplaying games: I found I was mostly playing these games out of desperation for meaningful interaction and chatting. Though I've replaced that with Discord servers now, so perhaps I should cut that out too.

<comment><USER22> Same! I replaced it with Manga, read a couple chapters in my downtime or during meals. You'd the surprised the depth of these, they are usually well written, basically an ongoing book.

</comment></comment><comment><USER23> Got married and had kids. Before that, I was happy working a 30k/year job, coming home and playing video games every day. It was a simpler, and more blissful time, but I was not progressing in any way.

<comment><USER24> Getting married and having kids is amazing at building up both focus and ambition.

</comment></comment><comment><USER25> I've played video games my entire life. I'm really good at them, and as a result, I enjoy them. Video games have always been my outlet, my "TV", my go- to when I just need to detach and relax. I play ~17 hours a week +/\- 3 hours.

I'm not as productive as I'd like to be in my side projects. So I'm trying something new that I started 2 days ago: Quitting video games ENTIRELY.

Here's my theory:

Video games are really fun. The instant gratification of landing a head shot. The skill, investment, and reward of becoming better, and better. The social atmosphere of team based coordination... These things have become my expectation for what is "fun" and "interesting". Years of gaming has reset my subconscious view of the world. How can reading compete with the excitement you get from a round of CS:GO? How can my mind be pulled to work on a long running side project, when I get stimulation and excitement from a game? I need to give my willpower a break, and reset my expectations of what "fun" is.

I'm going on a 30 -> 60 -> 90 day video game "detox" to assess whether or not my productivity (and other mental health factors) benefit.

In the first day (Saturday) I was far more productive around the house, because I was bored. I would not allow myself to play video games, so I took care of shit that I'd been putting off for months. So far, so good. I'll continue to monitor and see if this has been a net positive, or net negative decision (or neutral).

</comment><comment><USER16> Learned few simple HIIT exercises. Now when I am feeling tired, I do them for 5 minutes, and it resurrects me and boosts productivity significantly.

Plus regular exercises (heavy lifting once a week, and interval running 3 times a week) boost energy level and don't take much time.

</comment><comment><USER26> Started my own company. I know why we're doing things and why they are important. And I know that if I don't do some things they won't get done.

<comment><USER27> In a similar vein; I quit my job and started my company. The number of empty hours I spent trying to be/look busy at work was astounding. When it was my own company, my work ethic became more sensibly based on actual output, rather than perceived output.

</comment></comment><comment><USER28> Using a notebook. Just writing down observations (code, health, whatever) was incredibly powerful in making and evaluating changes.

<comment><AUTHOR> Do you use the notebook as a self evalation tool or something else? Can you give any examples?

</comment></comment><comment><USER29> I got a better keyboard. I had some bad typing habits that a regular keyboard was "allowing". I tended to reach across the keyboard with my dominant hand and left my non-dominant one to easily accessible keys. Needless to say, typing was slow and error prone.

Then I tried one of those keyboards that splits in the middle. It forced me to break my bad typing habits, I literally couldn't reach across the keyboard anymore, it was waaayy to far to move. My WPM went from 30 to 60 in about two weeks. (Microsoft Ergonomic Keyboard 4000, for those interested. About $40 on Amazon)

Typing faster allowed me to express my ideas much quicker. I could iterate faster, solve problems quicker, etc. etc. I started moving around the computer with my mouse less, so common operations like saving and opening files sped up.

</comment><comment><USER30> I moved my phone away from my person when charging it at night. I'll, without fail, spend an hour on it doing bullshit before going to bed if I don't.

</comment><comment><USER31> Installed Qbserve. Makes it easy to cut down on daily distractions.

[https://qotoqot.com/qbserve/](https://qotoqot.com/qbserve/)

<comment><AUTHOR> What have you discovered about your habits and time usage by time tracking?

</comment></comment><comment><USER32> I just came to terms with the fact that I work 100 times better with external motivation. Worked in school, works at the job, needed to find a way to make it work in personal life.

That's been a lot harder - still not good at it. Best I can do is announce things to people beforehand and then work at it as opposed to not working on it and risk appearing all talk.

I'm still working on finding internal motivation - but this is bridging the gap for now.

</comment><comment><USER33> 1) I built an app to help me form habits on a daily basis: [https://github.com/ioddly/meditations](https://github.com/ioddly/meditations) . Pretty simple, minimalistic, but having it open every time my computer does makes it low-friction to log all these things. There are loads of these; I wrote my own for fun and because I wanted to keep the information encrypted, locally.

2) I've started unplugging the internet. Like I literally pull the ethernet cord out of my computer and turn off my phone. I do it every night so that when I wake up, I code for about 4 hours without it. This has been the biggest boost to productivity and _happiness_ I've had in a long time.

Two issues with this so far:

a) Sometimes I hit a wall where I need to look something up before I can proceed, but I've never run out of work that I do know how to do. So I just write it down to search for later and work on something else.

b) I'm not sure how this would work with paying clients, managers, and so on. So far I've only done this on my own projects, in between clients.

</comment><comment><USER34> I used a browser plugin similar to StayFocusd to block social media and news sites while working. This helped wean me off of checking Hacker News throughout the day. This helped me focus much more on work and on enjoying my personal time. In a similar vein, get off social media as much as possible especially Twitter. I'm also at the point where I would include TV and netflix in general in this category, where you should wean yourself off of it.

Something that may help is to use a paper notebook to take notes and keep track of important todo items. I personally feel more productive with pen and paper but your milage may vary. I particularly like either legal pads or the moleskin-type journals.

For those introverts like myself, make sure to set up events to look forward to on a regular basis. Meet up with ex-coworkers, college friends etc. It definitely makes getting up in the morning easier knowing that you have something to look forward to.

</comment><comment><USER35> 1\. Serializing my tasks and assignments (to the extent possible).

2\. Doing my work more slowly and deliberately.

3\. Working in my own shop with nobody around (i.e. reduced distractions, no office chit-chat).

Not a complete list, but these 3 changes make me more productive than ever before, and with less stress.

(edit to add: not only is productivity greater, but the quality of my output is improved, too.)

</comment><comment><USER36> Make a prioritized list of things that need to be done with my time, and setting goals based on those lists.

I just start going down the list, and use the goals to measure whether my time is being used effectively. Also, don't let the perfect be the enemy of the good here. Make incremental improvements.

</comment><comment><USER37> Stop watching television, getting kids.

<comment><USER38> _getting kids_

Ah, the trial-by-fire approach to streamlining your life.

<comment><USER39> That's probably the most succinct way I've seen to articulate the Kid Effect. I'm going to steal that one!

</comment></comment></comment><comment><USER40> Started working remote.

Stopped setting alarms for getting up in the moring.

<comment><AUTHOR> How did no longer setting "wake up" alarms help?

<comment><USER40> I now always sleep as long as I need, which makes me wake up more refreshed.

<comment><USER40> Also, it leaves me with only 14 wake hours a day, lol

<comment><USER41> Not sure if you're joking. So you sleep 10 hours a day?

<comment><USER40> 9-10h yes

</comment></comment></comment></comment></comment></comment><comment><USER42> Don't think about productivity because it will introduce yourself to mental stresses that will derail your productivity. For a few simple things I have some ideas.

\- Do small changes

\- Break apart what you have to do

\- Realize what you can't do and instead do something you can.

</comment><comment><USER43> Good sleep, food and sport. It is the step 0 if you want to improve your productivity.

</comment><comment><USER44> Switched jobs. No longer on call doing DevOps means I can focus on each task knowing I'm not going to have to drop everything and work on a technical issue off hours.

</comment><comment><USER45> I started taking L-Theanine with my coffee in the morning. It's been about a month now and I find myself having incredible focus when I need to throughout the day.

<comment><AUTHOR> What are specfic benefits L-Theanine gives you? I've read that L-Theanine is more of a relaxant that counteracts the anxiety casuing effects of caffiene, so I can't really see how it helps you focus.

<comment><USER45> It helps me get into the "flow state" where I can work on just one thing and dive deep into it without thinking of all the other things I have to do or want to do.

</comment></comment></comment><comment><USER46> 1\. Spend ~3 minutes stretching and doing light exercise (pushups / situps) upon waking every morning.

2\. Skip breakfast. Just black coffee until lunch. The intention is to train your body to get its energy from fat reserves (a more stable source) instead of the sugars in the food you just ate.

3\. Cast aside desires, in the Buddhist sense. I found that, with just a little mental shift, I could "let go" of many daily frustrations that were sapping my energy.

EDIT: 4. GTD

</comment><comment><USER47> Made OS X's ssh-agent remember my passphrase today

</comment><comment><USER48> The biggest was deciding to work on things I love. For days when I'm feeling distracted, I use Freedom and it works pretty well.

</comment><comment><USER14> I started using a habit tracking app. I've always had things I've wanted to stick with (eating healthier, learning a second language, learning how to solve CS-heavier algorithm problems), and this has helped incentivize me to do a little bit each day, or just keep up with important daily tasks like cleaning or using skincare products.

<comment><USER49> Any app in particular that you recommend?

<comment><USER14> Habitica

</comment></comment></comment><comment><USER50> Exercise, water and sleep.

</comment><comment><USER51> Used website restrictors on multiple browsers to block out Facebook and other shit, then eventually stopped looking at Facebook altogether.

Also: had a baby, realized that my death is a certainty and that I need to make my dreams come true RIGHT NOW.

</comment><comment><USER52> Being in a relationship. When single, I would spend time & money on dating apps and going out. Now that time is spent with her at home where we can read, work on side projects and just be productive.

</comment><comment><USER53> Shifted my schedule 2 hours earlier so as to get to the office while it's still quiet and get some focus time in.

If there were any offices left in this city that weren't open plan, that would be the next step.

</comment><comment><USER54> Met my best friend through work and she changed my life, I enjoyed work more than ever, you can't choose to do this so I apologise but if you find it you're very lucky <3

<comment><USER8> I alway thought workplace dating was at least risky, and mostly just off limits?

<comment><USER54> We're not dating just great friends

</comment></comment></comment><comment><USER55> The greatest productivity boost was to get rid of internet altogether at home (say goodbye to Comcast) and work only at the office. Also, I downgraded my phone service plan and switched to 1 GB limit/month on the data plan. I also recommend getting rid of cable TV.

I became more efficient at work, with clear goal in mind that I had to finish my daily work in order to meet my hard-set deadline of 6pm. I was able to really focus and concentrate with greater intensity, since I couldn't do more work at home.

There were also other unintended benefits.

Not having internet at home allowed my mind to be free from "distractions" at home. At home, my mind was still engaged in the work-related stuff. In order to switch gears and to unwind, I was spending time on Youtube and mindless entertainment, but more often, I was vegging out and becoming an internet couch-potato.

Now, I tend to spend more time with the family, and I am able to focus on people and not technology. I am free from the burden of FOMO. I am thinking more clearly and creatively. I have more time for hobbies and side projects. If I really needed to Google something , I'd use my phone for quick search (again, being limited to 1GB limit so I didn't get side-tracked). I can't procrastinate by going on the net and getting lost in endless research.

And since I couldn't be online while at home, I was unconsciously building good habits. I am reading more books (and buying more paper-based books instead of e-books/Kindle books). I am writing more, journaling more, and getting more exercises and working out. I'm also sleeping better and no longer have insomnia, probably due to limited screen time in the evening.

I also became more selective of the type of entertainment, preferring quality over quantity, and elminating my binge-watching. Instead, I watch movies on Bluray/DVD and is a much better viewing experience. I recommend Netflix (snail mail service, not the online version).

During weekends, I have an excuse to go to a local coffee shop with good coffee and fast internet connection. For dealing with urgent issues that come up during off-hours, I can use my pre-paid LTE hotspot (Karma).

I also use my phone less, and now I use it mostly for maps, weather, and email.

If cutting the cord is not an option, an alternative is to set the parental control on the wifi router and use time restriction to block internet during evening and on weekends.

Also having good set of tools AND having mastery over them are important, but that's another topic.

</comment><comment><USER56> In recent weeks: disabling push notifications for social apps, getting up much earlier (also to beat morning rush hours), pomodoro.

</comment><comment><USER57> Left Facebook. Meditate. Turn the devices off when working and meeting humans on the physical plane.

</comment><comment><USER58> Blocked Hacker News at work!

</comment><comment><USER41> 1) Taking Modafinil[1][2] semi-regularly. I've always had problems focusing and being productive. Honestly I've always wondered if I have some form of ADD or something. I used to drink large amounts of caffeine but the effects after long term use declines dramatically due to tolerance and I found out I was lactose intolerant. So I tried Modafinil after hearing a lot about it. I personally find it to be an extremely useful tool for my productivity and even my social life. It's also a much better drug in comparison to caffeine (disclaimer: individual results may vary, do your research, I'm not a doctor, etc).

2) Write things down. Make a list, write a journal, what ever feels right and works for you; just dump thoughts or ideas from your mind onto paper. Make it as structured or unstructured as you desire. It might be projects, things you want to watch or buy or upgrade around the house, etc. My 'notes' are literally completely random things I've thought or been told immediately and want to remember later. Most of them I'll never see again, but I know they are there. Eventually some of these might make it into the next step.

3) Get some productivity/task software or devise your own system for tasks and reminders and actually stick with it. I use OmniFocus2[3] but use what ever works for you. A simple calendar and notes system would work for most people. I work from home and found myself just reverting to reddit or hacker news when bored, where as now I see if there's any tasks assigned for today and what needs doing and do those before I allow myself to relax for the day. Having my day already planned makes me so much more relaxed when I wake up. The alarm can go off and I don't have to worry that I forgot to email my client, or the tax statements need to be mailed today. It's already sorted out for me to do and I don't have to think about it. It frees the mind to think about what you're focusing on, or a problem that requires devoted attention.

4) Every few weeks or so, spend some of your down time reflecting and thinking about what you can automate to save time, or what you can change so that you're more productive. Automate and iterate upon your productivity systems like you would as if practising agile. You wont get it perfect the first time around. I identified tracking the time spent on different clients was taking a lot of my time by hand, so I automated my timesheets into a CSV format which is imported into Google Sheets and used in my books for invoices. Later I automated the invoice email too. I used to do that by hand. I also created a filter that forwards my client's emails into my OmniFocus inbox and I can set the tasks for a date which appears in my calendar with alerts. You can do a lot, even with out the expensive productivity apps.

5) Don't work against your own unique circumstances or biology, work with them. I have a sleep disorder[4] (unrelated to the Modafinil, I assure you) and had a really bad time working full time normal office hours. I lasted two years full time waking up at 7am but I was getting 3-5 hours sleep and as a result I got burnt out, depressed and anxious. I quit and currently contract remotely earning a lot less money than I could otherwise, but now I get to work during my own sleeping hours and I feel a lot more happy. I tried changing my sleeping pattern and tried a bunch of band aid solutions but I never had any success, where as I've had great success adapting my life around my biological abnormality.

6) Reduce friction. It's really obvious when you think of it. I learnt this when I was playing guitar. If I have a guitar sitting next to my desk already tuned and ready to play, it results in me playing guitar more regularly. If it's untuned and in a case, I'd play it much less regularly. Reduce friction required for you to get started.

7) Don't believe anyone who tells you they have the solution™. You are a unique individual with unique problems which require unique solutions. This applies to self help too. No one has the 'real' answer. You need to try, experiment, think, and decide for yourself. Modafinil might kill you. Notes might waste your time. You might spend $80 on a productivity app and never use it after the first week. You might be suited to orderly enforced sleeping patterns.

EDIT: Formatting, added #6, and added some references

[1] Wikipedia Modafinil: [https://en.wikipedia.org/wiki/Modafinil](https://en.wikipedia.org/wiki/Modafinil)

[2] Very informative write up about Modafinil from the lovely Gwern: [http://www.gwern.net/Modafinil](http://www.gwern.net/Modafinil)

[3] OmniFocus2: [https://www.omnigroup.com/omnifocus](https://www.omnigroup.com/omnifocus)

[4] Delayed Sleep Phase Disorder [https://en.wikipedia.org/wiki/Delayed_sleep_phase_disorder](https://en.wikipedia.org/wiki/Delayed_sleep_phase_disorder)

<comment><USER25> (5) has been one of the biggest struggles in my life. At times where I could sleep/wake naturally, I was a different person. I had more energy, I felt more optimistic, and alive. I still had my struggles to be sure, but sleeping in your 'natural' rhythm (whatever is native to you) is far superior to a forced sleep/wake cycle.

The problem is, even if you do contract work, or work remotely for a flexible company, you're beholden to your partner's sleep/wake cycle as well.

<comment><USER41> That's very true (depending on the partner's pattern, I guess), and not all contract work allows you to be asleep during the day, some still require phone meetings and the such.

Even working remotely from home, I still have occasional logistical problems because sometimes there are appointments at 9am, or social events in the late morning and this will always be the case.

Just going to have to work with what you've got and work around it to the best of your ability. Although I should probably point out that it is important to find out before hand if there's anything else going on that could be causing this and potentially be resolvable before you stop expending energy fixing something you can't solve.

Although, if you are still having troubles sleeping and waking naturally feeling refreshed do your own research and maybe ask your GP if Melatonin[1] would suit you. Using flux[2] is also a great tool to help get to bed earlier too as that actually increases your melatonin naturally. Melatonin is not really similar to any other sleeping pills and it seems to be quite safe and has a great return on investment[3].

You probably already know about it so sorry if this was an unrequested information dump :)

[1] Wikipedia: Melatonin [https://en.wikipedia.org/wiki/Melatonin](https://en.wikipedia.org/wiki/Melatonin)

[2] Flux: [https://justgetflux.com/](https://justgetflux.com/)

[3] Gwern on Melatonin [http://www.gwern.net/Melatonin](http://www.gwern.net/Melatonin)

</comment></comment></comment><comment><USER59> Exercise.

</comment><comment><USER60> Uninstalled Facebook and all other social media apps from my phone

</comment><comment><USER61> Stopped watching TV. Total life improvement all-around.

<comment><USER62> Does TV include Netflix/Youtube? I love watching those and can't really muster the energy to read after dinner until I go to bed..

<comment><USER55> Watching DVD/Bluray discs helps (vs watching unlimited contents from Netflix/Youtube), since it limits the number of hours I spend watching, and I can avoid binge-watching. I recommend Netflix (the snail mail service, not online streaming)

</comment></comment></comment><comment><USER63> In the vein of Michael Pollan ..

Say No. A lot. Mostly to your self.</comment>


The calculator that understands you. - <AUTHOR> http://en.gibney.org/calculator/ What do you think? <comment><USER2> Cool. Seems like a mix of Javascript, Python, and Ruby. Why just call it a calculator when it's basically an interactive programming environment?

<comment><AUTHOR> Well, it started as a calculator. And somehow it still is. You type stuff, the computer does calculations and shows the results.</comment></comment>


Teaching binary to 3rd Graders using the Socratic method - <AUTHOR> http://www.garlikov.com/Soc_Meth.html <comment><USER3> One day after a visit to the Computer History Museum, my SO and I got to see the live demo of the analytical engine they have there. We watched the gears turning and stopping to add up numbers, saw the complex mechanisms to handle carrying digits, and she asked me how this would work if it was binary and I just said "much more simply". Then she admitted that, even though she has been working as a developer and manager of developers for years, she never learned binary.

When we got home I got out a pad and pencil and got her to write down 0, then 1, then asked her, if you only had two digits, what would come next? Tentatively she wrote 1 0. THen I asked her to add 1 to it. We more or less carried on the way this transcript went, except instead of using aliens with two fingers I introduced AND, OR and XOR 'boxes' that 0s and 1s go in and come out. I hadn't planned any of this but by the end of it she was just about drawing the circuit diagram of a full adder with carry bit.

I'm sort of thrilled to see that what I was doing is precisely the socratic method. I love teaching, never really did much of it until I gave a course in Unix and shell scripting at an old job but for a week I had more energy at work than I ever did just programming or in meetings.

<comment><USER4> I'm also a member of the "Taught my wife binary just for fun" club, but I used fingers in a different way than Rick Garlikov did. I told her that there was a way to count to 512 using just your fingers, and let her work through how it might be possible using a similar question-answer trial and error approach. Once she realized that each finger had 2 states (up or down), she naturally recreated a binary counting system. It's a neat trick, and even comes in handy when trying to keep track of a large count of something. With kids, however, you may end up with behavior problems around the numbers 4 and 132 :)

<comment><USER5> "a way to count to 512"

1024 (or 1023), surely?

<comment><USER6> She wanted a sign bit.

</comment></comment></comment></comment><comment><USER7> Reading this gave me a warm, fuzzy feeling.

I can't imagine trying to teach 3rd graders binary using a standard method - <USER2> even have peers in college that struggle with it. Probably because it was just taught to them as something different - this weird language computers use, instead of them developing an intuitive sense for it. But whenever I try to explain it to them, or anyone else, I always try and explain it as "just like decimal, exactly what you already know."

The Socratic method really is much more interesting and captivating for students. For example, Walter Lewin's physics lectures (Which are well worth watching, even if you're not taking a physics class), which I'm currently watching to "supplement" my actual physics class in which the professor stares at the board and rambles.*

*Not to say that his lectures are the Socratic method - that's probably not feasible with a lecture hall of hundreds of students. But the way he teaches makes you feel like you're discovering everything again along with him.

</comment><comment><USER8> This is a great way to teach and Mr. Garlikov did an amazing job. It is hard work to "teach" this way because it requires student/teacher interaction (which is a lot harder than just standing there and lecturing). Coming up with the content is equally difficult.

But it there are so many more things students learn using this method.

One is they learn how to create new ideas from existing ones: "inventing". It really gets me when I hear people tell kids "don't re-invent the wheel".

<comment><USER9> >One is they learn how to create new ideas from existing ones

This is how our brains are wired to work: the more places we can cross- reference the material from, the more likely we can "derive" it again quickly even if we can't memorize it.

"shut up/memorize it/some things just are" kills the intention to learn faster than a speeding bullet to the brain.

</comment></comment><comment><USER10> This is wonderful.

My wife homeschools, and the math curriculum she uses uses a very similar method from the beginning.

My daughter knows "12" as "One-ten two" and "33" as "three-ten three" and says it that way. She also knows those mean twelve and thirty-three, but for the purposes of the math program she uses the place terminology.

We can only hope that it will give her a better understanding of what's going on than pure memorization, and the jury's out until she's older, but it's a fascinating way to teach.

I sometimes wish we were all born with eight or sixteen fingers, but that's just the CS/EE bias in me talking.

<comment><USER9> I'm very very interested in considering homeschooling. How did the article's method differ with your child, since the "class size" is reduced to one? Your child won't have the benefit of being "filled in", but maybe she feels that she owns 100% of the achievement?

By the way, "one-ten-two" and "three-ten-thee" is literally how the Chinese would pronounce their numbers (一十二,三十三). In a way I think it's helped me understand place values earlier.

<comment><USER10> The Socratic method can be frustrating with one child, because when she doesn't get it, she really doesn't get it, and it takes a lot of questioning to lead her down the right path again. Sometimes you just want to bang your head against the wall when you ask the simplest leading question and she gets it wrong. At least with a group most of the kids will get those questions right.

I think my wife and I use that teaching method quite naturally. I'm never inclined to just give our children the answer; they only learn when they arrive at the answer themselves.

</comment></comment></comment><comment><USER11> I love to learn using the Socratic method. One of my favorite books is: "The Little Schemer" which is great and twists my mind in ways that I didn't think where possible.

Anyway do you know of other books, on any topic, that use the socratic method?

<comment><USER9> Plato's Republic?

<comment><USER5> There must be shorter, easier Socratic dialogues one could read. Maybe Euthyphro, or something:

<http://classics.mit.edu/Plato/euthyfro.html>

</comment></comment></comment><comment><USER12> I learned how to count in binary using my fingers as digits probably about third grade. The pinkie is the 1. At that age, I thought it was pretty cool that I could count to 31 on one hand, and it stuck with me to this day. I'm sure I'll teach my son the same.

<comment><USER9> =) then you can tell people you are _this_ many years old this year, up until you're 31.

<comment><USER13> Genius! I can use that for another 4 months, then it'll have to be a pinky and a fist, but that's a little too suggestive for normal conversations.

</comment></comment></comment><comment><USER14> Captivating. Understanding something by answering questions on your own (even if guided) always feels more like true understanding. But what happens when we come to a point that requires mental leap beyond what a student can do? Is there a set of problems, or a set of students that are more suitable for Socratic method (3rd graders seem to do just fine at it)? Or is there a set of teachers that are more adept to teaching this way? Please give your answers through questions only.

<comment><USER15> If it requires a mental leap, then you are doing/teaching it wrong. Every large leap is just a bunch of small leaps.

<comment><USER16> Absolutely.

The hard part about teaching is recognizing when you've introduced a large leap for a good percentage of the class.

There's a famous math story that goes:

"A professor was at the chalkboard writing up a proof for his class. At one point he comes to a portion of the proof and says, 'And it's obvious this must be X'. At which point he pauses, the class waiting. Stares at the board for a minute. Then leaves the class without saying a word. He returns fifteen minutes later, continuing, 'Yes, it's obvious this must be X'."

</comment></comment></comment><comment><USER17> This is amazingly similar to Test Driven Development. In the purest form of TDD, you don't write a single line of code until you have a failing test. The failing test is the unanswered question. Then, you write the code that "answers that question." This means that each step of the way, you are confirming that prior principles are correctly understood by the human and the computer before building on those prior principles.

As the Agile theory puts it, this approach "maximizes feedback".

</comment><comment><USER18> This is very cool, and I'm going to try it when I can.

But just to nitpick, he did actually tell them plenty of things, it was not just questions.

2 Examples:

> Could it be because we have 10 fingers?

> No, only to you guys, because you were taught it wrong [grin] -- to the > aliens it is two. They learn it that way in pre-school just as you learn to > call one, zero [pointing to "10"] "ten". But it's not really ten, right? > It's two -- if you only had two fingers.

Not a criticism, just a nitpick.

</comment><comment><USER19> This gives me an idea. What if there were a virtual university that was entirely conducted via chat? Like Quora meets Convore.

<comment><USER9> I'm unfamiliar with Quora. How is it different from, say, yahoo answers or stackOverflow??

<comment><USER19> Quora is of greater intellectual merit than Yahoo Answers, and isn't siloed into verticals like Stack Exchange.</comment></comment></comment>


Developers Should Abandon Agile - <AUTHOR> https://ronjeffries.com/articles/018-01ff/abandon-1/ <comment><USER2> Never ascribe to malice, that which can be explained by incompetence.

I don't mean to be harsh on anyone, but after working for over a decade in enterprises, mediocrity seems to be the norm. There are of course bright and insightful people, but mediocrity is pretty much the standard. Take any good process, technical practice or whatever and see it be abused and misused.

With Agile what happens is a mediocre implementation that usually leads to the usual complaints we see about Agile. The number of times I've been told about how Scrum enables self-organising teams only to be told I have no control over the process because it has been standardised across the company.

Mediocrity demands cookie cutter solutions that can be standardised without need to engage thinking. If you work in an incompetent organisation, department or team, then there's no hope that agile or anything else can help you. In fact, the religious nature of Agile often works in favour of mediocrity as critics, even well-meaning ones, get labelled as waterfall sympathisers.

<comment><USER3> I hate Enterprise environments now after working in one for just a couple of years.

They are all about conformity, standards, following established routines, established chain of command. Endless meetings due to the need to 'sync' every little decision with team leaders, product owners, scrum masters, who in turn syncs with the team members on other teams, making sure information gets distorted, lost, confused.

I'm never again working in Enterprise until I'm 60 and just want to sit on my ass, do minimum work, get payed and retire.

<comment><USER4> With respect, that will never happen.

The days of being able to "retire" went out the window, when companies stopped giving employees pensions, and they started offering 401k plans.

Then they decided to get rid of all the employees, and use exclusively contractors for whom they don't have to pay any benefits at all. No 401k for you!

<comment><USER5> If your 401k isn't earning enough returns to let you retire, neither is your employer's pension fund, and it will become insolvent. The difference between pension and 401k is unlikely to be make-or-break, and when it is, it's more likely to break the pensioner (corporate bankruptcy, taxpayer sticker-shock, etc).

<comment><USER6> Pensions are great when they work, but it's impossible to predict solvency at retirement age. It's one of the most under-reported financial travesties, but your pension can be taken away when you need it. Even the public pensions are targets these days.

</comment></comment></comment></comment></comment><comment><USER7> Methodology is a polite fiction overlaid on company culture. Authoritaian cultures will turn any methodology into a cattle prod. Even a methodology that prioritized singing Kumbaya and gently praising each other over shipping software would turn the workplace into a dystopian hellscape in the wrong hands.

</comment><comment><USER8> I quipped in a retro once that uppercase-Agile is agile the same way the Democratic People's Republic of Korea is a Democratic People's Republic. This was shortly after a teammate of mine described the three-to-four-hour biweekly sprint planning meetings he was subjected to on a previous team.

Here's a tip: calculate the cost of every meeting by taking your salary (or an estimate of the average salary in the room), dividing by 52 and then again by 40, doubling it, and multiplying by the number of people and then again by the number of hours in the meeting. Alternatively, nevermind the salary calculations: subjecting 13 people to a 3 hour meeting wastes roughly a full- time human-week of productivity.

<comment><USER3> It doesn't matter to Enterprise that money is being lost. It's millions every day being wasted and they are still there, going strong. They are no longer competing because income is automatic and guaranteed unless they do something catastrophic.

<comment><USER6> Also, without paid overtime, workers are often expected to make up productivity outside of the meetings.

</comment></comment></comment><comment><USER9> This seems to fail to recognize—and consequently retain—the core failure of Agile. It's too squishy.

Agile is about finding and continually adapting methods that work for the team in its actual concrete environment, but the manifesto doesn't address how to do that, and the Agile literature is all about particular methodology and not about how you manage evaluating and adapting processes as a tesm.

The critical part of Agile has almost no coverage in the Agile literature.

</comment><comment><USER10> Agile works well in a well defined subset of projects. The precondition for success are well defined and known, a blanket agile ban is as sterile as global agile adoption.

And I say this as an agile critic.

<comment><USER9> > Agile works well in a well defined subset of projects.

No, specific methodologies like Scrum, Kanban, XP, etc., might do that (with different subsets for different methodologies.)

Agile is more an set of priorities for choosing how to build software than a methodology, though it often gets misused as a name for some methodology, most often recently some variant of Scrum (though early on, XP was probably more common.)

<comment><USER10> Did I say agile is a methodology?

<comment><USER9> No, _I_ said that what _you_ said is true of methodologies, but not of Agile.

<comment><USER10> except it is true that for whatever you want to call agile there are plenty projects agile values' simply won't and can't work.

i.e. hardware drivers. kernels. libraries built to spec. software upgrades. most products that aren't built on commissions too.

</comment></comment></comment></comment></comment><comment><USER11> I like many things about Agile and Scrum but their goals (in practice) are often a paradox of "flexibility, performed as rigidly as possible."

<comment><USER12> There are good things in agile and scrum, but Agile and Scrum? As soon as people start capitalizing their Methodology they stop thinking about what they do and why.

</comment></comment><comment><USER13> > poor developers in the "Code Mines of Ohio"

I'll have you know that Ohio has some pretty good developers and some pretty good Agile training.

<comment><USER14> I think he was sympathizing with the developers, not deriding their skills.

The "poor" in "to all those poor souls lost at sea" doesn't refer to the economic class of the souls.

<comment><USER13> Ohio isn't lost at sea. We've got a pretty good tech scene.

</comment></comment></comment><comment><USER15> It's interesting to think of moving "past" Agile to some other place.

There's an old saying in consulting. It sounds really facile and dumb, but it's actually quite deep: _people like doing what they like doing_. That is, inside of each of us we have proclivities to act in different ways. I like thinking conceptually and writing. This other person likes thinking tactically and keeping things organized. No matter what situation we find ourselves in, somehow or another I end up writing and thinking conceptually and this other person is responsible for keeping organized and worry about immediate problems.

The organization -- any organization -- is simply a collection of people like that. They have a natural equilibrium, and no matter what kinds of things you say you're doing or not doing, they eventually come back to that happy spot. What we're really talking about here is a version of regression to mean, only in a social sense.

If what I'm saying is true, what conclusions can we draw? My money says that anything worth doing should be something that makes you uncomfortable in some fashion. I'm not talking unrealistic deadlines or micro-management. "Being uncomfortable" could simply be the development team taking a day and working alongside the people they're trying to help.

I looked at this entire problem sideways in my Info-Ops book: [https://leanpub.com/info-ops](https://leanpub.com/info-ops) \-- Instead of looking at what people _did_ , I looked at how information was handled and moved around. I found it insightful. One of my conclusions is that discovering and creating anything of value is all about tests, either business or development tests. Thinking in terms of tests allows solutions to happen in dozens of ways, but whatever solution is chosen, you get the results you want. Compare that to the ways we usually do things, which is the reverse. Usually we start with some idea of how we want to do the solution and then try to use that to make something people want -- but it seems like we're never really sure that we're building the right stuff. And meanwhile we're all back to doing things we like doing.

Tests allow us to be ourselves while constraining what we're doing to things that are valuable. I think people grok the idea of tests when it comes to TDD. Somehow they lose focus when it's about other things, like processes, methods, rituals, and so forth. But frack, that's where they matter the most.

I don't think you go beyond agile by changing the name or disavowing it. Unless we come to terms with what the root of the problem is? It'll just be the same thing ten years from now with new buzzwords. We've been doing this for decades in technology. We should be able to do better by now. I don't want to keep playing whack-a-mole with buzzwords and people's happiness.</comment>


Folksy Update From Carol Bartz, Massive Outage Relegated to "PS" - <AUTHOR> http://techcrunch.com/2010/10/15/and-now-a-folksy-update-from-carol-bartz-massive-outage-relegated-to-ps/ <comment><USER2> Funny, I didn't realize yahoo was down (had a busy week, minimal time to get online). How was the yahoo outage coverage compared to say, Twitter?

As the article implies, her spin on this is HUGE.</comment>


The Expert at the Card Table: The Classic Treatise on Card Manipulation - c--misura http://en.wikipedia.org/wiki/The_Expert_at_the_Card_Table <comment><AUTHOR> Link to the actual book : [https://books.google.com/books?id=_7wyAQAAMAAJ&printsec=fron...](https://books.google.com/books?id=_7wyAQAAMAAJ&printsec=frontcover&source=gbs_ge_summary_r&cad=0#v=onepage&q&f=false)

</comment><comment><USER2> The Expert at the Card table is a classic, but pretty advanced for someone just getting started with card handling.

For anyone looking to learn more, I would strongly recommend some of the video tutorials available at [http://www.theory11.com/tricks](http://www.theory11.com/tricks) (some are free, many are cheap, and majority can be streamed online)

Specifically look for anything you can find by Jason England. That man is a modern master of card sleights if their ever was one, and over the years he has created some great walkthroughs for techniques from the Faro Shuffle to Palming to Dice Switching.

(Full disclosure, I have done some work for this site, but it's legitimately one of the greatest resources for learning more about this topic that I know of)

</comment><comment><USER3> Erdnase is like the Genesis of the card magic canon. While it has an important & worthwhile place on any cardworker's bookshelf (Dai Vernon basically considered it the bible), there are some newer & more modern treatises a little more accessible in terms of language, descriptions, illustration, and just overall instruction. The multi-volume Card College series by Roberto Giobbi comes to mind.

<comment><USER4> Yeah, Erdnase is the last thing I'd recommend to someone who wants to learn card work -- that is, I'd recommend it, but after all my other recommendations :) Erdnase was revolutionary as a catalog of slights and subtleties that existed -- but if you want to learn to _perform_ them, all you'll get from Erdnase is frustration.

<comment><USER5> What would you suggest?

<comment><USER6> _Card College_ by Roberto Giobbi is pricey but provides excellent instruction. If you don't mind reading older, more formal language (though not as old as Erdnase!), _The Royal Road to Card Magic_ by Hugard and Braue, and its sequel _Expert Card Technique_ , cover more material than Giobbi at a fraction of the cost, albeit with _slightly_ less attention to the subtleties of finger position.

<comment><USER3> Hugard and Braue are, again, totally canonical. (Almost sort of analogous to Thompson & Ritchie's published works on C/Unix, but for cards...sort of ;) They're cheap and easy to come by for <$10 each, and I agree that pound-for- pound, you're going to get more effects from them than anywhere else.

I do think for a _serious_ beginner right now, though, Giobbi is probably more appropriate. I would argue he offers considerably more detail on subtleties of handling and overall performance and in more accessible language which is important. It's kind of like you're getting the best of Erdnase, Hugard, Braue and so many of the greats who came after them in the 20th century distilled down to best practices with Giobbi's course. There's nothing wrong with taking it slow either. You don't have to get all the volumes at once. In fact, it would be better to spend a long time mastering each before buying and moving on to the next.

</comment></comment></comment></comment></comment><comment><USER7> For a fascinating look at one of the masters of card manipulation, see _Secrets of the Magus_ :

[http://rickyjay.com/NewYorker_RickyJay.pdf](http://rickyjay.com/NewYorker_RickyJay.pdf)

There was also a recent documentary on Ricky Jay (available on Netflix) called _Deceptive Practice_ :

[http://www.rickyjaymovie.com/](http://www.rickyjaymovie.com/)

<comment><USER8> I love Ricky Jay. My dad is a slight of hand specialist and his entire basement is essentially a magic library. Anyway, when I was a kid I took particular interest to Ricky's book on how to throw playing cards as he used topless models to demonstrate form.

Knowing how hard you can throw a card, I feel like I'm lucky that me and my brothers escaped childhood with our eyesight intact.

</comment></comment><comment><USER9> I have a copy of this, reprinted in 1940s sandwiched into another work by MacDougall. Lots of fun for a bored child. I still shuffle cards in the rather striking way he describes:

Cut the deck perfectly in half. This is easier than it sounds.

Pincer the halves at the end, and push the two other ends together.

Push harder, smoothly, and rotate your wrists opposite slightly. The two halves will fan into each other. With practice you can perform 2 (4?) perfect shuffles and end up with the cards in the same order you started in.

<comment><USER10> It takes 8 perfect shuffles to get back to the start.

[https://en.wikipedia.org/wiki/Faro_shuffle](https://en.wikipedia.org/wiki/Faro_shuffle)

</comment></comment><comment><USER11> Here's a nice video by Richard Turner demonstrating various card manipulation techniques:

[https://www.youtube.com/watch?v=11R-jy8DZt8](https://www.youtube.com/watch?v=11R-jy8DZt8)

<comment><USER12> And the guy is blind!

</comment></comment><comment><USER13> That's nothing, there are _whole books_ dedicated to some of these individual techniques and tricks, like 'Second Dealing'

[http://en.m.wikipedia.org/wiki/Second_dealing](http://en.m.wikipedia.org/wiki/Second_dealing)

[http://www.amazon.co.uk/Second-None-Art- Dealing/dp/098191666...](http://www.amazon.co.uk/Second-None-Art- Dealing/dp/098191666X/)

</comment><comment><USER14> I'm a big fan of "The Complete Works of Derek Dingle" and "The Secrets of Brother John Hamman"

Both are absolutely excellent.</comment>


Ask HN: Should you ship an MVP if your team isn't agile - <AUTHOR>

I've been working with a vendor who is clearly on to something product-wise but the version they shipped is buggy and simple things like modal window controls aren't working. They impressed in the beginning but now the bosses are talking about ditching them because they aren't able to fix the features they shipped in a timely manner. It really made me wonder if they've done damage by shipping too early. Thoughts? <comment><USER2> What I'm guessing you are looking at is a prototype, whether they know it or not, and it is rarely a good idea to simply try to fix the bugs in a prototype. They are great for validating early assumptions but typically should be thrown away once that cycle is completed and rewritten.

Trying to improve and fix prototype code is typically very challenging. It often has no architecture or structure, so changes and new features are slow to implement.

If this vendor doesn't understand this, or it seems likely that having them rewrite it would just result in another prototype quality result then your bosses are right to walk away.

<comment><AUTHOR> Great take! Any ideas for evaluating if they are stuck at the prototype phase? Perhaps tell-tale signs you've seen in the past?

<comment><USER2> It's hard to say without knowing the situation and the team involved better.

Almost any really new software or even feature generally needs some amount of prototyping initially and usually this will happen whether the team planned it that way or not. However, if this step of the development process wasn't communicated to you from the beginning then I would suspect that they are either ignorant of this, or at least their organization is (I assume this is a contract or agency situation?). Either situation will be a potential problem for your company since it means they will continue to accrue technical debt rather than iterating on the prototype.

Done properly the prototype is either all or mostly thrown out and re-built from the ground up to improve and solidify the architectural and software design aspects. This paves the way for future feature development to continue unfettered by technical debt and early defects. Trying to simple cover the defects with "duct tape" or "cowboy" code is likely to cause the rest of the work to slog on and future iterations an feature development will become very slow.

However, without knowing more about your situation I'm not sure how useful or correct my advice is here.</comment></comment></comment>


VBScript Injection via Gnome Thumbnailer - <AUTHOR> http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.html <comment><USER2> Wow, this looks pretty big for Linux/Gnome users. Does this affect other file managers besides Nautilus? (xfce's thunar, pcmanfm, etc.)

<comment><USER3> I have only tested with GNOME Files. James Lu tested other file managers, see here: [https://bugs.debian.org/cgi- bin/bugreport.cgi?bug=868705#msg...](https://bugs.debian.org/cgi- bin/bugreport.cgi?bug=868705#msg46)

Quote:

       * Add Enhances: caja, tumbler (>= 0.1.92~), nautilus, nemo
         These are some of the many file managers/thumbnailer programs that support
         desktop thumbnailers like exe-thumbnailer, and I have verified (at some
         point) that all of these work.</comment></comment>


Why Ice Cream Sounds Fat and Crackers Sound Skinny - <AUTHOR> http://alumni.stanford.edu/get/page/magazine/article/?article_id=63151

<comment><USER2> Interesting. Given the questions:

        Which brand of laptop seems bigger, Detal or Dutal?
        Which brand of vacuum cleaner seems heavier, Keffi or Kuffi?
        Which brand of ketchup seems thicker, Nellen or Nullen?

The first question may have affected the answers to the others. "Dutal" may trigger an association chain "Duty" -> "Heavy Duty" -> "Large", and then naturally all the other answers should be consistent with that one. Is there a mechanism scientists use to defend against such a "snowballing" effect?

<comment><USER3> Yes, ask the questions in random order

</comment></comment><comment><USER4> I wonder how much pronunciation affects the results. Given their questions:

        Which brand of laptop seems bigger, Detal or Dutal?
        Which brand of vacuum cleaner seems heavier, Keffi or Kuffi?
        Which brand of ketchup seems thicker, Nellen or Nullen?

In British English I only chose the 'u' for the second question (the first by association - Detal = metal). How would US Americans pronounce these?

<comment><USER5> Deh-tal, Doo-tal, Keh-fi, Kuh-fi, Neh-len, Nuh-len

</comment></comment><comment><USER6> Hmmm, I don't think I saw any other languages besides Spanish and English, is this really a universal effect across languages?

I am especially curious because I am inclined to believe that certain sounds are not distributed the same in all languages. This could mean that either this theory is untested on a broader set of languages, or that the typical vernacular in a language tends to avoid a certain type of word more than other languages.

</comment><comment><USER7> I actually have the opposite reaction in a way. When I hear ice cream in my head, I hear something like Julie Andrews saying it, and it sounds sweet and light. With cracker it has a thick American accent and sounds harsh and dense. I am from the US.

<comment><USER8> What do you mean by "thick American accent"?

<comment><USER9> Is there something confusing about the idea of an American accent? Americans certainly have no problem talking about an English accent as if Cockneys sound anything like Scousers. To American ears, of course, they actually do, because those accents share some characteristics that are nearly absent from all American accents (and vice-versa.)

<comment><USER8> > Americans certainly have no problem talking about an English accent as if > Cockneys sound anything like Scousers. To American ears, of course, they > actually do

As an American, I wouldn't say that; while I would say "English accent" in conversation, to me that means something more specific than just "anything from England", but less specific than one specific accent; in my head it's "James Bond but not Sean Connery" (I'm not very familiar with those movies, so I don't know the different actors). They probably have different specific accents, but they're similar-ish to me (in my limited exposure), but not something I'd ever confuse with like, Cockney (that being the only specific English accent I know by name).

So yeah, I'm not sure what he means by American accent. Being more familiar with the different regional accents, I'm curious which one he's referring to, since they're so diverse. I casually expected that since the US is so big, geographically, people might have more specific ideas of regional American accents.

You're probably right about the "because those accents share some characteristics", though. American accents sound so distinct to me, I never really thought about them being all sharing something distinctively American- identifying about them; I wonder what it is about them.

<comment><USER9> [https://en.wikipedia.org/wiki/North_American_English_regiona...](https://en.wikipedia.org/wiki/North_American_English_regional_phonology#General_American)

It's not mysterious, it's well studied and documented:)

<comment><USER8> Didn't cross my mind to check there. Thanks for the link.

</comment></comment></comment></comment></comment></comment><comment><USER10> As an outsider, the uncited studies sound suspiciously like the sort of thing that is guaranteed to generate statistically significant values with enough iterations...

</comment><comment><USER11> Does Frozen yogurt follow this logic? It seems like a harder sounding word might imply the health effects

</comment><comment><USER12> Once I've found a paper studying the brand names and how to create new ones that feels right and communicates the image you want.

<comment><USER13> Yes, those were some fun times.</comment></comment>


Why being a female founder sucks... and rocks - <AUTHOR> http://youruisucks.tumblr.com/post/10620484911/female-founder

<comment><USER2> That reminds me of an interesting article I read that may explain this: <http://www.psy.fsu.edu/~baumeistertice/goodaboutmen.htm>

It basically argues that historical "male expendability" has geared men towards a predisposition for higher risk endeavors.

</comment><comment><USER3> "If someone wants to fund me as a diversity candidate, I will take that shit all the way to the bank."

Ha ha ha ha. Right on.

On the topic of heels and tech events, here's a really cool lightning talk by Pamela Fox about whether feminine can be geeky: <http://www.youtube.com/watch?v=MIhPYefRndc>

</comment><comment><USER4> And.. they're girls. A smile and you'd give and pardon her anything. (I'm not saying that in a sexist way or to act like they've got it easy, I hope. It's just.. you know when they look at you, ask you to fix whatever bugs they have with _that_ smile? A nerd(boy) could smile as much as he wants, he'd better google and RTFM before asking to fix _that_ bug.)

<comment><AUTHOR> That has certainly been a facet of my experience in 15 years spent working in or adjacent to development departments. Although I think it has less to do with being attractive, or a woman, as being _cultured_ the way women have conventionally been.

We're taught to be polite, warm, and deferential, and to thank someone effusively when they do something for us. I've seen men work the same angle, though.

</comment></comment><comment><USER5> Do we really need an "old girls network" to complement the old boys network? I tend to respect the people who have the courage to do what they love, and who therefore do it with excellence. Tara sounds like someone I'd respect. Welcome to the old hacker's club ... Here's to meritocracy.</comment>


CS171 - Data Visualization at Harvard - <AUTHOR> http://www.seas.harvard.edu/courses/cs171/

<comment><USER2> Looks like a pretty neat course. I've been meaning to jump in to the Processing language for a while now; never had enough time to.

If you're in to data visualization, I would highly recommend Edward Tufte's beautiful tome _Envisioning Information_ <http://www.amazon.com/exec/obidos/tg/detail/-/0961392118/> . (Which reminds me, Amazon, please introduce some decent looking permalinks. Am I giving away my SID with that link or what?)

You may know Tufte from his wonderful essay lambasting PowerPoint and it's role in the Columbia shuttle disaster: [http://www.edwardtufte.com/bboard/q-and-a-fetch- msg?msg_id=0...](http://www.edwardtufte.com/bboard/q-and-a-fetch- msg?msg_id=0001yB) .

<comment><USER3> No, you aren't giving away your SID. The random-looking number is the ASIN of the product. (You could have reassured yourself by reasoning as follows: everything apart afrom that final number clearly contains very little product- specific or user-specific information; and there surely isn't enough information in a 10-bit number to identify both a product and a user uniquely.)

I don't think it's reasonable to expect Amazon to have product URLs with no random-looking unique ID in at all, and 10 digits seems pretty modest. But I don't see why they couldn't make <http://www.amazon.com/ASIN/0961392118> take you to their main page for that book.

<comment><USER2> Okay, I admit, I was being cheeky :) But there was a whole section of the query that I left out that looks like this:

      ref=sr_1_1?ie=UTF8&s=books&qid=1238082049&sr=1-1

This all looks like info they use for clickstream analysis, so nothing too critical. But I wish they had basic functionality on the page itself to generate a URL like you just gave. Maybe with some more info as well like tufte-envisio-XXXXXXXXXX.

</comment></comment></comment><comment><USER4> You need a login to see the videos from the links shown. Only Harvard students will have that. Unless you go to <http://www.cs171.net> and choose "2008 Videos on iTunes U" Then (through iTunes) you can get to CSCI E-64 which seems like the same thing taught through the "extension school".

<comment><USER5> Try this link for the spring 2009 lecture videos:

<http://cm.dce.harvard.edu/2009/02/22872/videopage.shtml>

<comment><USER4> Thanks, that works really well

</comment></comment></comment><comment><USER6> Sounds interesting.

Hanspeter Pfister is a very smart guy.</comment>


Developers Are Not Idiots - <AUTHOR> https://www.cryptologie.net/article/466/developers-are-not-idiots <comment><USER2> I think this critique applies to any specialised profession dealing with a different profession - just because they don't know what you know, doesn't make them idiots. I'm thinking developers and product owners etc.

I do think our industry, overall, has a problem with what I call the "alpha nerd" clash, where people who have, if they're like me, often prided themselves on their intelligence (comparative to their peers) in their schooling etc. and perhaps been ostracised for their intellect and/or its pursuits, still pursue that need to feel smarter than others, which can lead to self-congratulatory sneering.

But it's never conducive to a high functioning team - and effective teams deliver effective products. And a team is nearly always a vertical slice of a company to some extent, so yeah, you might have a team of developers, but the testers, the product owners, the BAs, the sales people, they're all part of the team delivering that product, and while you have experience and knowledge that they don't have, they also have experience and knowledge that you don't have, so some empathy and humility are essential.

<comment><USER3> > just because they don't know what you know, doesn't make them idiots

If you're making a product, then it's your responsibility to do so in a way that doesn't put your users or the general public in danger. Not knowing security best practices when you get started doesn't make you an idiot, but releasing something without first putting in the work to learn and then implement the best practices kind of makes you a shitty person.

I mean otherwise you might as well just say something like, "I just wanted to make a car, I don't care if it's safe or not because that's not the fun part."

<comment><USER4> A big problem with security is that you don't know what you don't know.

Want to allow users to upload image?

* Make sure submitted files are actually images * Limit file size to prevent denial of service * Normalize the filename to prevent directory traversal * Add a randomized component to filenames to prevent users from overwriting each other's files * Serve file with the proper content type * HTML encode filename for display

Then, oops, you didn't know SVGs allowed JavaScript, so now you have stored XSS.

I don't think that's negligence, it's just not something you'd necessarily know until you saw it. And this doesn't even consider language quirks and gotchas that are even more esoteric.

<comment><USER3> > Then, oops, you didn't know SVGs allowed JavaScript, so now you have stored > XSS.

Right, but presumably you're using the standard techniques to mitigate XSS, e.g. sanitizing all other text input, using an X-XSS-Protection header, using a CSP that only allows scripts that have been whitelisted, etc.

Even if you don't know that an SVG can contain js, that shouldn't put your users at risk if you're doing everything else correctly. And then when that gets caught in an audit or reported by a user or as part of a bug bounty, you can fix it. (Although if you're going to be serving up a certain UCG file type to users, I don't think it's unreasonable to expect people to Google for vulnerabilities associated with that file type.)

Developers shouldn't be expected to have perfect security knowledge or to never make mistakes, but I think it is reasonable to expect them to not be grossly negligent. I don't want to live in a world where only people wealthy enough to afford full security audits before they get any traction should be allowed to launch products, but I also think developers should be held accountable if they're recklessly endangering people.

<comment><USER5> And while you are doing all that your manager is breathing down your neck to finish the damn thing and your competitor has already released a comparative feature that you are developing.

In the ideal world, companies would give developers enough time to figure out security. But in practice, most companies/businesses just want you to ship ASAP.

</comment></comment></comment></comment></comment><comment><USER6> I wish security experts would spend more time writing libraries. "Never roll your own security" isn't helpful when all you have are scrypt, bcrypt, and pbkdf, and you have to implement a complete auth system by yesterday.

It is a lot more fun to poke holes than to be poked, though, so I understand it.

<comment><USER7> They do! For instance, for the crypto problems David studies, security experts wrote Nacl, which brought cutting edge curve and AEAD crypto to developers with an almost user-proof interface.

<comment><USER8> #NotAllSecurityExperts

Only pointing that out, because apparently this was a big deal on Twitter a couple weeks back, where one group of experts were arguing that you weren't a real security expert without being able to code, and the other group arguing the contrary.

<comment><USER9> How can you be a security expert insofar as the domain is software if you can't code?

<comment><USER10> They can understand common patterns and find problems. That doesn't mean they can fix them.

<comment><USER9> You can probably tell people how to physically secure their premises or not to put passwords on post it notes without knowing how to code but you can't help them write secure code if you can't you know code.

This is like taking drivers ed from someone who can't drive. In theory you could reiterate material you had read on the matter and some material may even be of value but only a fool would learn to drive from someone who can't.

The fact that not everyone is willing or able to see the emperor is a nudist doesn't mean his threads are real.

<comment><USER10> Many code-related security problems can be discovered externally without even seeing the code (simple examples: XSS attacks, SQL injection problems, etc.) Generic advice like "escape your inputs" can be provided. I am not saying this is _valuable_ advice...

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> That kind of demand requires a simple mindset: make doing the right thing easier than not. I was impressed, when working for mature software companies, how the teams providing internal tools that were easily overlooked (security, data logging, experimentation framework) managed to lead by having the best option easily accessible.

You don't want people to write passwords in your codebase? Make getting the password as an environment variable easier to find; document where they are, how to refresh them; better: change them often and have the system that changes them support the use case better than a human with an easy to compromise post-it.

You don't want people to store personally-identifiable information? Make all the relevant information associated with an irreversible hash; have all the business logic that process logs into something legible matching that hash. Soon, no one will use the `user_id` that is also used in the public profile URL.

It's significant amount of initial work but that beats repeating basic things for every new joiner, by a mile.

<comment><USER12> > You don't want people to store personally-identifiable information? Make all > the relevant information associated with an irreversible hash; have all the > business logic that process logs into something legible matching that hash. > Soon, no one will use the `user_id` that is also used in the public profile > URL.

I don't understand this. The user_id in the URL is not itself meaningful. If you know that my user_id in Slack is 642819733, that information is neither personally identifiable nor useful in any way.

But if you exfiltrate a bunch of data from Slack and learn user 642819733's birthday and billing address, then you've probably managed to identify me. You've done it even if you didn't know beforehand that there _was_ a user_id 642819733. The problem wasn't that 642819733 was a sensitive value; the problem was that it was the same value in all of Slack's records. Which your solution doesn't address.

<comment><USER11> The case that I have in mind assumes that you are an analyst who should know better, and was asked about… say, retention. You need a personal identifier in that table to match successive purchase by the same individual.

You can easily get your friend's `user_id` because, well they share it on- line. If it is easy for me to take that 642819733 and find how much you spend, I can confront you and claim you are registered to more Slack channel than you have told me about. So it's less "exfiltration" and more: some junior people are commonly given detailed data, for legitimate reasons, and you should make it hard for them to abuse it.

There are plenty of cases that I've been directly involved with where I was uncomfortable, but not sure I want to share them. I'll just say this: Facebook analysts typically can type their own ID off the top of their head, and most know the ID of their close co-workers. I've never seen anything bad, but doing something bad felt a little too easy at times — and that _ease_ was a big deal.

</comment></comment></comment><comment><USER13> Another problem I have with this sort of security person is the assumption that security risks always trump other risks.

A few years ago we found some vulnerabilities on a server of ours, and some of the security folks were really upset we didn't immediately shut down the server. I argued that we needed to weigh the risks of the vulnerability vs the risk of shutting down the server immediately. Both actions involved risk, and we needed to weigh which was more severe.

Just because something is a security risk doesn't make it the most important thing automatically. It has to be analyzed in the context, and triaged in similar ways as other risks we discover in our work.

<comment><USER7> The problem with this logic is that the risk of "shutting the server down" is almost always financial loss to the software firm, and the risk of "leaving it up" is often harm to end-users, who are an externality in the equation you're describing.

<comment><USER13> Sometimes, but shutting down the server can also harm users, if it is providing services that those customers rely on.

</comment></comment></comment><comment><USER14> Security is not the most important thing. It's second at best.

I am reminded of Yegge's old platform rant[1], and the part about "Accessibility":

> When software -- or idea-ware for that matter -- fails to be accessible to > anyone for any reason, it is the fault of the software or of the messaging > of the idea. It is an Accessibility failure.

> Like anything else big and important in life, Accessibility has an evil twin > who, jilted by the unbalanced affection displayed by their parents in their > youth, has grown into an equally powerful Arch-Nemesis (yes, there's more > than one nemesis to accessibility) named Security. And boy howdy are the two > ever at odds.

> But I'll argue that Accessibility is actually more important than Security > because dialing Accessibility to zero means you have no product at all, > whereas dialing Security to zero can still get you a reasonably successful > product such as the Playstation Network.

1\. The first copy Google found for me is here. People should read the whole thing: [https://gist.github.com/chitchcock/1281611](https://gist.github.com/chitchcock/1281611)

<comment><USER7> For cat sharing startups, maybe, but for a large fraction of real-world apps, not so much: it is better not to be available than to compromise the data of your users.

<comment><USER15> Things like to prevent XSS should just be in any web programming standart lib. A lot of bugs are just there because people have to write for so many problems there own solution.

Now we move so many things to a just digital world. But the ground is just like sand. I often think todays software is just like the tower of Pisa.

I work in automation industry with PLCs. There are funny things possible with "Industry 4.0" but .. to keep it secure .. to keep it running for 20-30-40 years ..

</comment></comment></comment><comment><USER16> A lot of this may come down to learning materials.

If you go pick up some books and tutorials on how to learn X, I can pretty much guarantee that they're going to follow a pattern of "here's how to build a basic functional and maybe useful application" and security is going to be an afterthought if it's considered at all. As you continue to learn, there's a fair chance that you'll start with expanding on some of what you've already done in building that sample application - the one with no security.

<comment><USER17> This was one of the critique of "Applied Cryptography", see [https://blog.cryptographyengineering.com/2011/11/07/in- defen...](https://blog.cryptographyengineering.com/2011/11/07/in-defense-of- applied-cryptography/)

> The detailed argument goes something like this: Applied Cryptography > demystified cryptography for a lot of people. By doing so, it empowered them > to experiment with crypto techniques, and to implement their own code. No > problem so far.

> Unfortunately, some readers, abetted by Bruce's detailed explanations and > convenient source code examples, felt that they were now ready to implement > crypto professionally. Inevitably their code made its way into commercial > products, which shipped full of horribly ridiculous, broken crypto > implementations. This is the part that was not so good. We're probably still > dealing with the blowback today.

The follow up book from Schneier (Cryptography Engineering) included a whole chapter on "bringing in experts if you deal with cryptography).

</comment></comment><comment><USER18> > the mindset of someone who is writing an application is to build something > cool

As a developer, this rubbed me the wrong way. "Building something cool" is definitely a thing we all like to do, and every developer worth their craft has introduced some features just because they found them "cool"; that said, developers' "mindset" nearly completely focuses on several activities, with a varying level of importance depending on a number of factors:

        a) building something that works as close to the specifications as possible
        b) making sure that other developers can maintain it, and also that it can be deployed, tested etc
        c) (optional) making it as efficient as possible

Or, as the saying attributed to Kent Beck [1] goes: "make it work, make it right, make it fast". The "cool" factor is usually present, but is on a much lower level of importance than the above three. There are others, sitting in between and sometimes even rising to the top, with security definitely being one of them. But because of the focus on particularly "a" and "b" above, the developers simply don't have the level of understanding of security issues as is implied that the experts expect ("idiots" being a shortcut for anyone below that level). So they introduce the security features the best they can, such as that example of the key in the PHP app described in the article.

[1] [http://wiki.c2.com/?MakeItWorkMakeItRightMakeItFast](http://wiki.c2.com/?MakeItWorkMakeItRightMakeItFast)

</comment><comment><USER19> There are lots of good reasons why application developers sometimes don't write secure code. For example, security can be an afterthought if the logic is so complex that you can barely get it working in the first place. Another example is that it's not necessarily clear when you write a component that it will be exposed to potentially malicious inputs. And there's always pressure to ship a working product so, without a clear mandate from the organization, security can fall by the wayside as a priority.

One thing that's _not_ a valid reason is the one that the author gave. "Hur dur I develop web apps and I've never heard of XSS" isn't excusable. You have to know about this stuff, even if it's not your expertise.

<comment><USER7> Where do you draw the line? They need to know about XSS. Presumably you think they need to know about SSRF, too. What about clickjacking? Cache poisoning? What percentage of web developers in the industry do you think understand cache poisoning attacks?

<comment><USER20> The answer for that would ideally be all? We, as developers should be aware and ready to learn and build the experience around security , but a different thing are focus and ownership. You still want experts to drive specialized fields. I run all my architecture reviews by the security team and ask them to comment- internal RFCs. Very similar approach as with infrastructure/devops. Except the gap between dev and security is wither than between dev and ops. I recognize that is very dependent on both organizations and individuals but I shy away from hiring people that at don't have at the very minimum the interest or awareness in security. I also shy away from business that see security as an afterthought

<comment><USER7> I just want the standard to be coherent. If it's "you have to know everything", then fine, let's say that. But saying things like "at least they should know the OWASP Top 10" doesn't make much sense to me.

<comment><USER3> Aren't most (non-insider) data breaches the result of OWASP top 10 things though? If the goal of security is to make sure the costs of stealing an asset exceed the value of that asset, then ensuring that the least-expensive-to- exploit vulnerabilities have been mitigated first seems like a good place to start.

The fact that there may be other vulnerabilities that are just as dangerous doesn't mean it's equally bad to have vulnerabilities like that, if they require more time and sophistication to exploit. E.g. you shouldn't have string comparison timing vulnerabilities in your code, but having them is less bad than a SQL injection attack even if they can both lead to the same result.

<comment><USER7> No, I don't think there's much science to the OWASP Top 10.

</comment></comment></comment></comment></comment></comment><comment><USER21> _and you realize that you haven 't written the login page yet. It now dawns on you that you will have to figure out some rate-limiting password attempt mechanism, a way for people to recover their passwords, perhaps even two- factor authentication... But you don't want to do all of that, do you?_

If you are trying to write your own login and authentication system, I dare say that you probably are an idiot or really smart.

Statistically, it's probably the former.

<comment><USER17> It is more and more common to have frameworks include blueprints for login pages, but it used not to be the case at all. I wouldn't say that it's that common nowadays either.

<comment><USER21> Most frameworks have an easy way to offload user authentication to third parties like Facebook, Amazon, Twitter, Google, etc. I would trust any of them to get it "right" before I would trust most developers.

If you need authentication for an internal corporate app, there is always authentication with the corporate directory services or something like Okta.

<comment><USER22> Security doesn't exist in a vacuum. It's only one of multiple concerns. For instance:

> offload user authentication to third parties like Facebook, Amazon, Twitter, > Google, etc.

Have fun getting that through the GDPR compliance audit.

</comment></comment></comment></comment><comment><USER23> The way you have defined "developer", you have defined an idiot. An unethical, incompetent idiot.

Our purpose, as computer engineers, is to convince piles of carefully-cooked rocks ("computers") to do a very specific thing repeatedly ("computing"). Since humans are terrible at understanding specificity, we design languages and abstractions that help us encode our goals into computer-readable codes.

At no point is "build something cool" the goal other than during recreational programming; our goal is not even to build, necessarily, but to understand the requirements of our users and to help them use their resources more effectively. To this end, "cool" is totally worthless; it is a facet of design, of product, and of marketing. Let them focus on the spectacle. We must focus on the specification.

Why don't developers care about security? Because we have raised them to not care about security. We have failed to instill a desire for security into our culture. Consider: Computers have been remotely hackable since the dawn of the Internet. (Check out the history of SSH or email for terrifying examples.) We do not have the cultural norms necessary for getting security correct; we barely know how to distrust soliciting strangers on the street, let alone Martian or Christmas-tree TCP packets.

How can I help? Well, I can try to shove POLA [0] and capabilities [1] down everybody's throat, but so far, it's been like trying to convince people that the world is a globe [2].

Here's how _you_ can help. Pick up a single easy security meme, think about it for a while, and then pass it on. I recommend starting with "security should not be optional" if you're a FLOSS developer, or "everybody is on the security team" if you have a corporate employer.

[0] [https://en.wikipedia.org/wiki/Principle_of_least_privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege)

[1] [http://habitatchronicles.com/2017/05/what-are- capabilities/](http://habitatchronicles.com/2017/05/what-are-capabilities/)

[2] [https://corbinsimpson.com/words/globe.html](https://corbinsimpson.com/words/globe.html)

</comment><comment><USER24> The current story above this is "Oklahoma Department of Securities Leaked Millions of Files".

<comment><USER2> Which was due to a server not properly secured from the Internet - so most likely a sysop or devop, or Dave the guy from accounts who is pretty good with computers, messed up. Cute though.

</comment></comment><comment><USER25> Essential security practices (not advanced PT skills) should be basic software quality concerns. Full stop. "But it works" is not an excuse e.g. for doing sql queries without proper parameter binding.

</comment><comment><USER26> All generalizations are false.

<comment><USER27> True.

</comment></comment><comment><USER28> I'm sorry but this is way too click bait-ish for my taste. I always assume that no one is stupid.

<comment><USER29> You may do, but that isn't ubiquitous.

</comment></comment><comment><USER27> I know a lot of developers developers developers who are tactless, careless, and yeah basically idiots. So much of Silicon Valley is made up of this type that stands next to working legacy code and takes credit for it.</comment>


Nuxt/content Git based headless CMS - <AUTHOR> https://content.nuxtjs.org/ <comment><USER2> Thats pretty cool. When I started a website recently I did something similar by hand, just so that I set it all up ready to accept data being plugged into it, rather than hardcoding it into the pages. Then when I got more time I went back and put a proper CMS behind the site.</comment>


Obama signs America Invents Act into law, makes patent reform a reality - <AUTHOR> http://www.engadget.com/2011/09/16/obama-signs-america-invents-act-into-law-makes-patent-reform-a/

<comment><USER2> Really? School House Rock's _How a Bill Becomes a Law_ is Engadget's idea of a "Video recap of the patent reform process"? Thanks for furthering civil education I guess.

<comment><USER3> Agreed, that video didn't address patents at all. It just shows how bills pass congress, senate and president to become laws.

The eleven second 'family-man' version might give you some consolation:

<http://www.youtube.com/watch?v=uf2q66G3lmM></comment></comment>


Maker Aware Of 40% Failure In Hip Implant - <AUTHOR> http://www.nytimes.com/2013/01/23/business/jj-study-suggested-hip-device-could-fail-in-thousands-more.html

<comment><AUTHOR> This one brings up a few interesting issues we seem to discuss around here. Regulation and the FDA, rates of failure (This provides a bit of a contrast to the oft-repeated refrain that software engineering is the least mature of all engineering disciplines -- how common is 40% failure in the medical industry?)

Perhaps a bit bourgeois for HN, but I thought it might stimulate discussion.</comment>


When the H-1B Transfer Denials Crisis Hits Home - <AUTHOR> https://people.ai/blog/when-the-h-1b-transfer-denials-crisis-hits-home/ <comment><USER2> I'm a former h1-b visa holder. Had If I not had option to move to another company in 2014 I would have made my life miserable. New company allowed me to grow professionaly, make great friends and earn money my family deserves.

</comment><comment><USER3> When the broader discussion is about AI replacing the workforce, here's a company committed to leave no employee behind. Leaders like Oleg and a company like People.ai are a rare breed and a welcome change.

</comment><comment><USER4> Sad story, but great article.

</comment><comment><USER5> Strongly agree! The United States was built by hard working immigrants.</comment>